Guanping Zhang created CXF-9243:
-----------------------------------
Summary: AuthorizationCodeGrantHandler consumes (burns)
authorization code before performing validation (PKCE/redirect_uri), causing
availability DoS on legitimate retries
Key: CXF-9243
URL: https://issues.apache.org/jira/browse/CXF-9243
Project: CXF
Issue Type: Bug
Components: JAX-RS Security
Affects Versions: 4.2.3
Environment: Apache CXF 4.2.3, OAuth2 Authorization Code Grant with
PKCE.
Reporter: Guanping Zhang
h3. Problem
In AuthorizationCodeGrantHandler, the authorization code is consumed (removed
from the data provider store) at line 57 BEFORE any validation checks are
performed. The expiry check, client_id match, redirect_uri match, and PKCE
verification all run AFTER the code is already deleted.
If ANY check fails (e.g., an attacker intercepts the code and submits a
wrong/absent code_verifier for a PKCE-protected public client), the flow throws
INVALID_GRANT — but the code is permanently burned. The legitimate client's
subsequent correct retry receives null and fails with HTTP 400.
h3. Impact
This is an availability defect (CWE-400 / CWE-367). While PKCE successfully
prevents the attacker from obtaining a token (confidentiality preserved), the
consume-first ordering defeats the availability guarantee for the legitimate
user, who did everything correctly but is denied access due to the attacker's
interference.
h3. Suggested Fix
Reorder the logic to peek-and-validate: retrieve the grant, perform all
validation checks (including PKCE), and only consume (delete) the code
atomically if all checks pass.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
