PT-2024-7968 · Eclipse · Eclipse Dataspace Components

Marta Rybczynska · Published 2024-09-11 · Updated 2024-09-19 · CVE-2024-8642

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Dataspace Components versions 0.5.0 through 0.9.0

Description The issue is related to the ConsumerPullTransferTokenValidationApiController component, which has inadequate authentication procedures. This allows a remote attacker to bypass the token expiration check. The vulnerability requires a dataplane configured to support http proxy consumer pull and includes the module "transfer-data-plane". The affected code was marked deprecated from version 0.6.0 in favor of Dataplane Signaling and was removed in version 0.9.0.

Recommendations For Eclipse Dataspace Components versions 0.5.0 through 0.8.0, update to version 0.9.0 or later to resolve the issue. For Eclipse Dataspace Components version 0.9.0, no action is required as the vulnerable code has been removed. As a temporary workaround, consider disabling the ConsumerPullTransferTokenValidationApiController function until a patch is available. Restrict access to the transfer-data-plane module to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-303

CWE-305

Related Identifiers

BDU:2024-09481

CVE-2024-8642

GHSA-8259-2X72-2GVC

Affected Products

Eclipse Dataspace Components

References · 15

• https://github.com/eclipse-edc/Connector/commit/04899e91dcdb4a407db4eb7af3e7b6ff9a9e9ad6 · Patch
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/234 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8642 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8642 · Security Note
• https://osv.dev/vulnerability/GHSA-8259-2x72-2gvc · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09481 · Security Note
• https://github.com/eclipse-edc/Connector/releases/tag/v0.9.0 · Note
• https://github.com/eclipse-edc/Connector/blob/bcb2e42aee82ce1863be3dcbdab29919d39a0e97/extensions/control-plane/transfer/transfer-data-plane/src/main/java/org/eclipse/edc/connector/controlplane/transfer/dataplane/api/ConsumerPullTransferTokenValidationApiController.java · Note
• https://github.com/eclipse-edc/Connector · Note
• https://t.me/cvedetector/5353 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1833917101691503056 · Twitter Post
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/28 · Note
• https://t.me/cvenotify/95272 · Telegram Post
• https://gitlab.eclipse.org/security/cve-assignment/-/issues/28 · Note
• https://twitter.com/CVEnew/status/1833865958798336343 · Twitter Post