CVE-2024-39315: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response
First published: Tue Jul 02 2024(Updated: )
### Impact The Pomerium user info page (at `/.pomerium`) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be more severe in the presence of an XSS vulnerability in an upstream application proxied through Pomerium. If an attacker could insert a malicious script onto a web page proxied through Pomerium, that script could access these tokens by making a request to the `/.pomerium` endpoint. Upstream applications that authenticate only the ID token may be vulnerable to user impersonation using a token obtained in this manner. Note that an OAuth2 access token or ID token by itself is not sufficient to hijack a user's Pomerium session. Upstream applications should not be vulnerable to user impersonation via these tokens provided: - the application verifies the [Pomerium JWT](https://www.pomerium.com/docs/capabilities/getting-users-identity) for each request, - the connection between Pomerium and the application is secured by mTLS, - or the connection between Pomerium and the application is otherwise secured at the network layer. ### Patches Patched in Pomerium v0.26.1. ### Workarounds None ### For more information If you have any questions or comments about this advisory: - Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues) - Email us at [security@pomerium.com](mailto:security@pomerium.com) Credit to Vadim Sheydaev, aka Enr1g for reporting this issue.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/pomerium/pomerium | <0.26.1 | 0.26.1 |
| <0.26.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-39315?
CVE-2024-39315 is considered a medium severity vulnerability due to the potential exposure of OAuth2 access and ID tokens.
How do I fix CVE-2024-39315?
To fix CVE-2024-39315, upgrade to Pomerium version 0.26.1 or later, where the issue has been addressed.
What type of data is exposed in CVE-2024-39315?
CVE-2024-39315 exposes serialized OAuth2 access and ID tokens from the user's session, which are not intended for end-user visibility.
Which software versions are affected by CVE-2024-39315?
CVE-2024-39315 affects all versions of Pomerium prior to 0.26.1.
What is the potential impact of CVE-2024-39315 in conjunction with an XSS vulnerability?
The impact of CVE-2024-39315 could be significantly amplified if an XSS vulnerability is present, allowing attackers to exploit the exposed tokens.
- agent/title
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/references
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-rrqr-7w59-637v
- alias/CVE-2024-39315
- agent/software-canonical-lookup
- collector/github-advisory
- agent/trending
- agent/source
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- package-manager/go
- vendor/pomerium