CVE-2022-22576: OAUTH2 bearer bypass in connection re-use

How it was found

Summary:

A cached connection authenticated with the OAUTH2 mechanisms can be reused by a subsequent request even if the bearer is not correct. This affects SASL-enabled protcols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

An application that can be accessed by more than one user (such as a webmail server) would be affected by this flaw.

Steps To Reproduce:

curl 'imap://server:port/path/;MAILINDEX=1' --login-options 'AUTH=OAUTHBEARER' -u user: --oauth2-bearer validbearer --next 'imap://server:port/path/;MAILINDEX=1' --login-options 'AUTH=OAUTHBEARER' -u user: --oauth2-bearer anything

Supporting Material/References:

• Patch 0001-url-check-sasl-additional-parameters-for-connection-.patch fixes this flaw.

As an alternative to apply the patch, use another (unused) password within each request: the second request in the command below will properly fail. curl 'imap://server:port/path/;MAILINDEX=1' --login-options 'AUTH=OAUTHBEARER' -u user:dummy1 --oauth2-bearer validbearer --next 'imap://server:port/path/;MAILINDEX=1' --login-options 'AUTH=OAUTHBEARER' -u user:dummy2 --oauth2-bearer anything

Impact

Access (read/write) unauthorized data