{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2024-4536", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2024-05-06T07:05:31.518Z", "datePublished": "2024-05-07T13:11:45.310Z", "dateUpdated": "2024-08-01T20:40:47.492Z" }, "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "modules": [ "Connector" ], "packageName": "technology.edc", "product": "EDC", "repo": "https://github.com/eclipse-edc/Connector", "vendor": "Eclipse Foundation", "versions": [ { "lessThanOrEqual": "0.6.2", "status": "affected", "version": "0.2.1", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "sovity GmbH" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "
In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component (https://github.com/eclipse-edc/Connector), an attacker might obtain OAuth2 client secrets from the vault.

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component (https://github.com/eclipse-edc/Connector) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.

\n

This feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.



" } ], "value": "In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault.\n\nIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.\n\nThis feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-201", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2024-05-07T13:11:45.310Z" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b" }, { "tags": [ "related" ], "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3" }, { "tags": [ "issue-tracking", "vendor-advisory" ], "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22" }, { "tags": [ "issue-tracking", "vendor-advisory" ], "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198" } ], "source": { "discovery": "UNKNOWN" }, "title": "Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-4536", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-07T14:50:50.630941Z" } } } ], "affected": [ { "cpes": [ "cpe:2.3:a:eclipse_foundation:edc:*:*:*:*:*:*:*:*" ], "vendor": "eclipse_foundation", "product": "edc", "versions": [ { "status": "affected", "version": "0.2.1" } ], "defaultStatus": "unknown" } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:53:35.014Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:40:47.492Z" }, "title": "CVE Program Container", "references": [ { "tags": [ "patch", "x_transferred" ], "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b" }, { "tags": [ "related", "x_transferred" ], "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3" }, { "tags": [ "issue-tracking", "vendor-advisory", "x_transferred" ], "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22" }, { "tags": [ "issue-tracking", "vendor-advisory", "x_transferred" ], "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198" } ] } ] } }