CVE-2024-8642: Eclipse EDC: Consumer pull transfer token validation checks not applied
In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8642?
CVE-2024-8642 has a high severity due to the potential for unauthorized access through token expiration bypass.
How do I fix CVE-2024-8642?
To fix CVE-2024-8642, upgrade the Eclipse Dataspace Components to version 0.9.0 or later.
What components are affected by CVE-2024-8642?
CVE-2024-8642 affects Eclipse Dataspace Components versions from 0.5.0 to 0.9.0.
Can CVE-2024-8642 be exploited remotely?
Yes, CVE-2024-8642 can be exploited remotely due to insufficient token validation.
Is a patch available for CVE-2024-8642?
Yes, a patch for CVE-2024-8642 is available in the form of an upgrade to version 0.9.0 or later.