CVE-2024-5037: Openshift/telemeter: iss check during jwt authentication can be bypassed
A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON web token (JWT) authentication.
Other sources
Description: When verifying the iss field, telemeter uses strings.Split(tokenData, ".") to extract the payload, which means that the user should submit a Compact type JWS Token. However, go-jose's jwt.ParseSigned(tokenData) also supports authenticating JWS Token of JSON type. That means if the attacker submits a Token like:
{ "fakeiss":".eyJpc3MiOiJhY2NvdW50cy5nb29nbGUuY29tIn0.", "protected":"", "header":"", "payload":"", "signature":"" }
The attacker can forge a token issued by Google to pass the verification(for example). If two server use the same pair of key, the attacker can use the token from the first server to deceive the second server, and cause the privilege escape. The original reporter has raised this issue to Kubernetes, and they have fixed this problem: https://github.com/kubernetes/kubernetes/pull/123540
---
https://github.com/openshift/telemeter Version: 4.17 Related Code: https://github.com/openshift/telemeter/blob/a9417a6062c3a31ed78c06ea3a0613a52f2029b2/pkg/authorize/jwt/clientauthorizer.go#L78
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5037?
CVE-2024-5037 is classified as a medium severity vulnerability due to its ability to allow an attacker to bypass JWT authentication under certain conditions.
How do I fix CVE-2024-5037?
To fix CVE-2024-5037, update your OpenShift Container Platform and OpenShift Distributed Tracing to the latest versions provided by Red Hat.
Which versions are affected by CVE-2024-5037?
CVE-2024-5037 affects Red Hat OpenShift Container Platform version 4.0 and Red Hat OpenShift Distributed Tracing version 2.0.
What kind of attack can CVE-2024-5037 enable?
CVE-2024-5037 allows an attacker to forge tokens and bypass the issuer check during JWT authentication.
Is there a workaround for CVE-2024-5037?
There are no specific workarounds for CVE-2024-5037; updating to the patched versions is recommended.