PT-2024-31579 · Eclipse · Eclipse Dataspace Components

Sovity Gmbh · Published 2024-05-07 · Updated 2024-05-07 · CVE-2024-4536

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Eclipse Dataspace Components versions 0.2.1 through 0.6.2

Description A security issue has been identified in the EDC Connector component of Eclipse Dataspace Components, related to the OAuth2-protected data sink feature. When using a custom OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. The clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This allows an attacker to potentially obtain OAuth2 client secrets from the vault. The feature is now disabled entirely due to incomplete implementation of necessary code paths.

Recommendations For Eclipse Dataspace Components versions 0.2.1 through 0.6.2, consider disabling the OAuth2-protected data sink feature entirely, as it has been disabled in the latest implementation due to security concerns. Restrict access to the EDC Connector component to minimize the risk of exploitation. Avoid using the clientSecretKey in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-201

CWE-522

Related Identifiers

CVE-2024-4536

GHSA-2X52-8F29-7CJR

Affected Products

Eclipse Dataspace Components

References · 9

• https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b · Patch
• https://osv.dev/vulnerability/GHSA-2x52-8f29-7cjr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4536 · Vendor Advisory
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4536 · Security Note
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/22 · Vendor Advisory
• https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3 · Note
• https://github.com/eclipse-edc/Connector · Note
• https://twitter.com/CVEnew/status/1787888344971510234 · Twitter Post