PT-2024-29655 · Unknown · Biscuit-Java

Geal · Published 2024-07-31 · Updated 2024-08-09 · CVE-2024-41948

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions biscuit-java versions prior to 4.0.0

Description The issue concerns the generation of third-party blocks for authentication and authorization tokens in microservices architectures. A malicious user can forge a third-party block request, tricking the third-party authority into generating datalog that trusts the wrong keypair. This can be achieved by altering the public keys field in the ThirdPartyBlockRequest and replacing the actual public key with a different one, allowing the attacker to use the token without obtaining a third-party block from the intended authority.

Recommendations For biscuit-java versions prior to 4.0.0, upgrade to version 4.0.0 to fix the issue. As a temporary workaround, consider restricting the use of third-party block requests until the patch is applied. Avoid using altered symbol tables in ThirdPartyBlockRequest to prevent exploitation.

Exploit

Fix

Weakness Enumeration

CWE-1259

Related Identifiers

CVE-2024-41948

GHSA-5HCJ-RWM6-XMW4

Affected Products

Biscuit-Java

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41948.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-41948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41948 · Security Note
• https://osv.dev/vulnerability/GHSA-5hcj-rwm6-xmw4 · Vendor Advisory
• https://github.com/biscuit-auth/biscuit/security/advisories/GHSA-rgqv-mwc3-c78m · Note
• https://github.com/biscuit-auth/biscuit-java · Note
• https://github.com/biscuit-auth/biscuit-java/releases/tag/4.0.0 · Note
• https://github.com/biscuit-auth/biscuit-java/security/advisories/GHSA-5hcj-rwm6-xmw4 · Note
• https://github.com/biscuit-auth/biscuit-java/commit/2e05e7b3f8f2aae38f33294f19419e2d638cb564 · Note
• https://t.me/cvedetector/2295 · Telegram Post