PT-2024-26120 · Keycloak+2 · Keycloak+2

Theo-Ritense

·

Published

2024-05-13

·

Updated

2024-05-14

·

CVE-2024-34706

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Valtimo versions prior to 10.8.4 Valtimo versions prior to 11.1.6 Valtimo versions prior to 11.2.2
Description Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to api.form.io via the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io component. To perform this attack, an attacker needs to have access to the network traffic on the api.form.io domain, the content of the x-jwt-token header must be logged or otherwise available to the attacker, the attacker needs to have network access to the Valtimo API, and the attacker needs to act within the time-to-live of the access token, which is 5 minutes by default in Keycloak.
Recommendations For versions prior to 10.8.4, update to version 10.8.4 or later to resolve the issue. For versions prior to 11.1.6, update to version 11.1.6 or later to resolve the issue. For versions prior to 11.2.2, update to version 11.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the api.form.io domain and the Valtimo API to minimize the risk of exploitation. Additionally, ensure that the content of the x-jwt-token header is not logged or otherwise made available to potential attackers.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-34706
GHSA-XCP4-62VJ-CQ3R

Affected Products

Form.Io
Keycloak
Valtimo