CVE-2024-1233: Eap: wildfly-elytron has a ssrf security issue
A flaw was found in JwtValidator.resolvePublicKey in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.
Other sources
In JwtValidator.resolvePublicKey, the Validator checks jku and sends an HTTP request. During this process, no whitelisting or other filtering behavior was performed on the destination URL address. Caused SSRF vulnerability.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1233?
CVE-2024-1233 is classified as a high-severity vulnerability due to its potential for server-side request forgery.
How do I fix CVE-2024-1233?
To mitigate CVE-2024-1233, upgrade to a version of JBoss EAP that includes a patched version of wildfly-elytron-realm-token greater than 2.4.0.CR1.
What versions of JBoss EAP are affected by CVE-2024-1233?
CVE-2024-1233 affects versions of JBoss EAP that include wildfly-elytron-realm-token up to and including 2.4.0.CR1.
What impact does CVE-2024-1233 have on systems?
CVE-2024-1233 could allow an attacker to perform unauthorized HTTP requests to internal systems, potentially exposing sensitive information.
Is CVE-2024-1233 related to JWT validation?
Yes, CVE-2024-1233 involves a flaw in JWT validation where public key retrieval does not whitelist URLs, leading to security risks.