Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

 1token, err := tokenAuth.Issue(c, &auth.IssueTokenArgs{
 2    User:               user,
 3    ClientID:           s.ClientID,
 4    Scopes:             authCode.Scopes,
 5    RefreshTTLOverride: refreshTTLOverride,
 6})
 7 
 8Location:
 9 
10- service/oauth/oauth.go
11 
12In Issue(...), the access token includes Scopes but does not include ClientID:
13 
14accessToken, err := jwt.NewWithClaims(jwt.SigningMethodHS256, Claims{
15    TokenType: TokenTypeAccess,
16    RegisteredClaims: jwt.RegisteredClaims{
17        Subject:   uidEncoded,
18        NotBefore: jwt.NewNumericDate(issueDate),
19        ExpiresAt: jwt.NewNumericDate(accessTokenExpired),
20    },
21    Scopes: args.Scopes,
22}).SignedString(t.secret)
23 
24By contrast, the refresh token does include both:
25 
26Scopes:   args.Scopes,
27ClientID: args.ClientID,
28 
29Location:
30 
31- pkg/auth/jwt.go
32 
33During request authentication, scopes are only inserted into request context if ClientID is present:
34 
35if claims.ClientID != "" {
36    util.WithValue(c, ScopeContextKey{}, claims.Scopes)
37}
38 
39Location:
40 
41- pkg/auth/jwt.go
42 
43Then CheckScope(...) skips scope enforcement if no scopes are present in context:
44 
45hasScopes, tokenScopes := GetScopesFromContext(c)
46if !hasScopes {
47    return nil
48}
49 
50Location:
51 
52- pkg/auth/jwt.go
53 
54RequiredScopes(...) relies on this check:
55 
56if err := auth.CheckScope(c, requiredScopes...); err != nil {
57    c.JSON(200, serializer.Err(c, err))
58    c.Abort()
59    return
60}
61 
62Location:
63 
64- middleware/auth.go
65 
66Sensitive route groups protected by RequiredScopes(...) include:
67 
68- Files: Files.Read / Files.Write
69- Shares: Shares.Read / Shares.Write
70- Workflows: Workflow.Read / Workflow.Write
71- User settings and security info
72- WebDAV device/account management
73- Admin APIs: Admin.Read / Admin.Write
74 
75Location:
76 
77- routers/router.go
78 
79## Reproduction steps
80 
811. Create or use an OAuth client with a low-privilege scope, for example only openid.
822. Complete the OAuth authorization code flow for a normal user with:
83 
84scope=openid
85 
863. Exchange the authorization code via:
87 
88POST /api/v4/session/oauth/token
89 
904. Decode the returned access token.
91 
92Expected token metadata should preserve enough OAuth client/scope context for later enforcement.
93 
94Actual behavior:
95 
96- The access token contains the requested scopes.
97- The access token does not contain client_id.
98 
995. Use the returned token as a bearer token:
100 
101Authorization: Bearer <access_token>
102 
1036. Call an API that requires a scope not granted to the OAuth app, for example an endpoint requiring Files.Read,
104   Files.Write, UserInfo.Write, or DavAccount.Write.
105 
106Expected result:
107 
108- The request should fail with an insufficient-scope error.
109 
110Actual result:
111 
112- The scope check is skipped because no scopes were inserted into the request context.
113- The request is processed as that user.
114 
115If the authorizing user is an administrator, the same issue can affect admin APIs requiring Admin.Read or Admin.Write,
116because the request still runs as the admin user and the admin identity check can pass while the OAuth scope check is
117skipped.
118 
119## Impact
120 
121This is not an anonymous authentication bypass. The attacker still needs a valid OAuth access token for a real user.
122 
123The impact is an OAuth consent/scope boundary bypass:
124 
125- A third-party OAuth app can request a minimal scope such as openid.
126- After the user authorizes it, the app receives an access token.
127- That token can be used as a broader bearer token for the same user's Cloudreve account, despite not being granted
128  the required scopes.
129 
130For normal users, this may allow access to or modification of files, shares, workflows, user settings, and WebDAV
131account/device settings depending on available APIs.
132 
133For administrator users, it may allow access to admin-scoped functionality without the OAuth app being granted
134Admin.Read or Admin.Write.
135 
136## Suggested fix
137 
1381. Include ClientID: args.ClientID in access token claims when issuing OAuth access tokens:
139 
140accessToken, err := jwt.NewWithClaims(jwt.SigningMethodHS256, Claims{
141    TokenType: TokenTypeAccess,
142    RegisteredClaims: jwt.RegisteredClaims{
143        Subject:   uidEncoded,
144        NotBefore: jwt.NewNumericDate(issueDate),
145        ExpiresAt: jwt.NewNumericDate(accessTokenExpired),
146    },
147    Scopes:   args.Scopes,
148    ClientID: args.ClientID,
149}).SignedString(t.secret)
150 
1512. Consider making scope handling fail closed for OAuth tokens with malformed or inconsistent OAuth metadata.
1523. Add regression tests for an OAuth access token granted only openid attempting to call APIs requiring:
153    - Files.Read
154    - Files.Write
155    - UserInfo.Write
156    - DavAccount.Write
157    - Admin.Read
158    - Admin.Write
159 
160Each should fail with an insufficient-scope error unless the corresponding scope was granted.