Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identitys unverified provider email to a victims address, which Plane matches directly to the victims existing local account. The attacker can then log in to the victims Plane account without knowing the victims password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.
Weakness
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/114.html
- https://cwe.mitre.org/data/definitions/115.html
- https://cwe.mitre.org/data/definitions/151.html
- https://cwe.mitre.org/data/definitions/194.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/57.html
- https://cwe.mitre.org/data/definitions/593.html
- https://cwe.mitre.org/data/definitions/633.html
- https://cwe.mitre.org/data/definitions/650.html
- https://cwe.mitre.org/data/definitions/94.html
References
- https://github.com/makeplane/plane/commit/b91b61c379908d9e451613dbca23fc3803e926d2
- https://github.com/makeplane/plane/pull/9289
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-7j95-vh8g-f365
- https://github.com/makeplane/plane/security/advisories/GHSA-7j95-vh8g-f365