CVE-2023-37260
📋 TL;DR
This vulnerability in league/oauth2-server exposes cryptographic keys in error messages when keys are passed as strings without valid passphrases. Attackers could potentially extract sensitive keys from exception logs, compromising OAuth 2.0 security. Only affects PHP applications using league/oauth2-server version 8.3.2 through 8.5.2 with string-based key configuration.
💻 Affected Systems
- league/oauth2-server
📦 What is this software?
Oauth2 Server by Thephpleague
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain private keys from error logs, enabling them to impersonate the OAuth server, issue fraudulent tokens, or decrypt sensitive data, leading to complete authentication system compromise.
Likely Case
Sensitive cryptographic keys exposed in application logs accessible to unauthorized users, potentially allowing token forgery or privilege escalation.
If Mitigated
Limited exposure with proper log sanitization and access controls, but still represents an information disclosure vulnerability.
🎯 Exploit Status
Exploitation requires access to application error logs or the ability to trigger the specific exception condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.5.3
Vendor Advisory: https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm
Restart Required: Yes
Instructions:
1. Update composer.json to require "league/oauth2-server": "^8.5.3"
2. Run composer update league/oauth2-server
3. Restart PHP application/web server
4. Verify no breaking changes in your implementation
🔧 Temporary Workarounds
Use file-based key configuration
allPass cryptographic keys as file paths instead of strings to avoid the vulnerable code path
Modify CryptKey constructor calls to use file paths: new CryptKey('/path/to/key.pem', 'passphrase') instead of new CryptKey($keyString, 'passphrase')
🧯 If You Can't Patch
- Implement strict access controls on application logs to prevent unauthorized access
- Configure error logging to exclude sensitive data or use log sanitization filters
🔍 How to Verify
Check if Vulnerable:
Check composer.lock for league/oauth2-server version between 8.3.2 and 8.5.2, and verify if CryptKey is instantiated with string keysCheck Version:
composer show league/oauth2-server | grep versionsVerify Fix Applied:
Confirm league/oauth2-server version is 8.5.3 or higher in composer.lock📡 Detection & Monitoring
Log Indicators:
- LogicException messages containing cryptographic key material
- Error logs showing full key strings in exception traces
Network Indicators:
- Unusual authentication patterns or token validation failures
SIEM Query:
source="application.logs" AND "LogicException" AND ("CryptKey" OR "pass phrase")🔗 References
- https://github.com/thephpleague/oauth2-server/pull/1353
- https://github.com/thephpleague/oauth2-server/releases/tag/8.5.3
- https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm
- https://github.com/thephpleague/oauth2-server/pull/1353
- https://github.com/thephpleague/oauth2-server/releases/tag/8.5.3
- https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm
