CVE-2024-39315: Pomerium exposed OAuth2 access and ID tokens in user info endpoint response
Impact
The Pomerium user info page (at /.pomerium) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users.
This issue may be more severe in the presence of an XSS vulnerability in an upstream application proxied through Pomerium. If an attacker could insert a malicious script onto a web page proxied through Pomerium, that script could access these tokens by making a request to the /.pomerium endpoint.
Upstream applications that authenticate only the ID token may be vulnerable to user impersonation using a token obtained in this manner.
Note that an OAuth2 access token or ID token by itself is not sufficient to hijack a user's Pomerium session. Upstream applications should not be vulnerable to user impersonation via these tokens provided: - the application verifies the Pomerium JWT for each request, - the connection between Pomerium and the application is secured by mTLS, - or the connection between Pomerium and the application is otherwise secured at the network layer.
Patches Patched in Pomerium v0.26.1.
Workarounds None
For more information If you have any questions or comments about this advisory:
- Open an issue in pomerium/pomerium - Email us at security@pomerium.com
Credit to Vadim Sheydaev, aka Enr1g for reporting this issue.
Other sources
Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at /.pomerium) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be more severe in the presence of a cross-site scripting vulnerability in an upstream application proxied through Pomerium. If an attacker could insert a malicious script onto a web page proxied through Pomerium, that script could access these tokens by making a request to the /.pomerium endpoint. Upstream applications that authenticate only the ID token may be vulnerable to user impersonation using a token obtained in this manner. Note that an OAuth2 access token or ID token by itself is not sufficient to hijack a user's Pomerium session. Upstream applications should not be vulnerable to user impersonation via these tokens provided the application verifies the Pomerium JWT for each request, the connection between Pomerium and the application is secured by mTLS, or the connection between Pomerium and the application is otherwise secured at the network layer. The issue is patched in Pomerium v0.26.1. No known workarounds are available.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39315?
CVE-2024-39315 is considered a medium severity vulnerability due to the potential exposure of OAuth2 access and ID tokens.
How do I fix CVE-2024-39315?
To fix CVE-2024-39315, upgrade to Pomerium version 0.26.1 or later, where the issue has been addressed.
What type of data is exposed in CVE-2024-39315?
CVE-2024-39315 exposes serialized OAuth2 access and ID tokens from the user's session, which are not intended for end-user visibility.
Which software versions are affected by CVE-2024-39315?
CVE-2024-39315 affects all versions of Pomerium prior to 0.26.1.
What is the potential impact of CVE-2024-39315 in conjunction with an XSS vulnerability?
The impact of CVE-2024-39315 could be significantly amplified if an XSS vulnerability is present, allowing attackers to exploit the exposed tokens.