[deps] Auth: Update Duende.IdentityServer to 7.0.8 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
Duende.IdentityServer	7.0.6 -> 7.0.8

GitHub Vulnerability Alerts

CVE-2024-49755

Impact

IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even without possessing the private key for signing proof tokens.

Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the LocalApiAuthenticationHandler for authentication. It does not impact:

• OAuth or OIDC protocol endpoints defined by IdentityServer, such as the authorize and token endpoints.
• Typical UI pages within an IdentityServer implementation, which are not normally authorized with the local API authentication handler.
• The use of DPoP to create sender-constrained tokens in IdentityServer that are consumed by external API resources.
• The use of DPoP to sender-constrain refresh tokens issued to public clients.

Are you affected?

This vulnerability only affects IdentityServer implementations that are using the local APIs feature of IdentityServer and have explicitly enabled DPoP for local APIs. The local api authentication handler is configured with a call to either AddLocalApi or AddLocalApiAuthentication, and the opt-in to DPoP for local APIs is enabled via the TokenMode option.

Vulnerable implementations of IdentityServer would have configuration code similar to the following:

services.AddAuthentication()
    .AddLocalApi("local", options => 
    {
        options.TokenMode = LocalApiTokenMode.DPoPAndBearer; // or LocalApiTokenMode.DPoPOnly
    });

Patches

This vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs.

---

Release Notes

DuendeSoftware/IdentityServer (Duende.IdentityServer)

v7.0.8

Compare Source

This is a security hotfix that addresses CVE-2024-49755, a low-severity vulnerability in our handling of DPoP access tokens at local APIs. See
our blog post and the security advisory for more details.

v7.0.7

Compare Source

This is a patch release that allows the UserInteractionOptions.PromptValuesSupported to be customized, in order to support custom prompt modes.

What's Changed

• Allow SupportedPromptModes customization by @​josephdecock in https://github.com/DuendeSoftware/IdentityServer/pull/1582

Full Changelog: DuendeSoftware/products@7.0.6...7.0.7

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Please upload report for BASE (main@6cc097e). Learn more about missing BASE report.
Report is 8 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4953   +/-   ##
=======================================
  Coverage        ?   42.57%           
=======================================
  Files           ?     1386           
  Lines           ?    64632           
  Branches        ?     5933           
=======================================
  Hits            ?    27516           
  Misses          ?    35892           
  Partials        ?     1224           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[bitwarden-bot]

Internal tracking:

• ID: PM-14205
• Link: https://bitwarden.atlassian.net/browse/PM-14205