CVE-2020-37281: Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and present it as a bearer token to the Management API, impersonating administrators to gain full platform control.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Gravitee API Management deployments through 4.12.22 are exposed if they retain the shipped default jwt.secret. The affected interface is the Management API.
What does an attacker need to exploit this?
An attacker needs network access to the Management API and knowledge of an existing user ID. They can create an HS256 JWT using the default secret and submit it as a bearer token; no prior authentication is required.
What access can a successful attacker obtain?
An attacker can impersonate any existing user, including an administrator. Administrator impersonation can provide full control of the platform.
How can I determine whether my deployment is affected?
Check whether the Management API JWT configuration still uses the shipped default jwt.secret and whether the deployment is version 4.12.22 or earlier. A deployment using a non-default secret is not described as vulnerable by the provided information.