{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-4536", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2024-05-06T07:05:31.518Z", "datePublished": "2024-05-07T13:11:45.310Z", "dateUpdated": "2024-08-01T20:40:47.492Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Connector"], "packageName": "technology.edc", "product": "EDC", "repo": "https://github.com/eclipse-edc/Connector", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "0.6.2", "status": "affected", "version": "0.2.1", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "sovity GmbH"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component (<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/eclipse-edc/Connector\">https://github.com/eclipse-edc/Connector</a>), an attacker might obtain OAuth2 client secrets from the vault.</div><div><br></div><div><p>In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component (<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/eclipse-edc/Connector\">https://github.com/eclipse-edc/Connector</a>) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.</p>\n<p>This feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.</p><br></div><br>"}], "value": "In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault.\n\nIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.\n\nThis feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2024-05-07T13:11:45.310Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"}, {"tags": ["related"], "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"}, {"tags": ["issue-tracking", "vendor-advisory"], "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"}, {"tags": ["issue-tracking", "vendor-advisory"], "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"}], "source": {"discovery": "UNKNOWN"}, "title": "Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4536", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-07T14:50:50.630941Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:eclipse_foundation:edc:*:*:*:*:*:*:*:*"], "vendor": "eclipse_foundation", "product": "edc", "versions": [{"status": "affected", "version": "0.2.1"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:53:35.014Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:40:47.492Z"}, "title": "CVE Program Container", "references": [{"tags": ["patch", "x_transferred"], "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"}, {"tags": ["related", "x_transferred"], "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"}, {"tags": ["issue-tracking", "vendor-advisory", "x_transferred"], "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"}, {"tags": ["issue-tracking", "vendor-advisory", "x_transferred"], "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b", "tags": ["patch", "x_transferred"]}, {"url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3", "tags": ["related", "x_transferred"]}, {"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22", "tags": ["issue-tracking", "vendor-advisory", "x_transferred"]}, {"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198", "tags": ["issue-tracking", "vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:40:47.492Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4536", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-07T14:50:50.630941Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:eclipse_foundation:edc:*:*:*:*:*:*:*:*"], "vendor": "eclipse_foundation", "product": "edc", "versions": [{"status": "affected", "version": "0.2.1"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-07T14:57:50.407Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "sovity GmbH"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/eclipse-edc/Connector", "vendor": "Eclipse Foundation", "modules": ["Connector"], "product": "EDC", "versions": [{"status": "affected", "version": "0.2.1", "versionType": "semver", "lessThanOrEqual": "0.6.2"}], "packageName": "technology.edc", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b", "tags": ["patch"]}, {"url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3", "tags": ["related"]}, {"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22", "tags": ["issue-tracking", "vendor-advisory"]}, {"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198", "tags": ["issue-tracking", "vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault.\n\nIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.\n\nThis feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.\n\n", "supportingMedia": [{"type": "text/html", "value": "<div>In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component (<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/eclipse-edc/Connector\">https://github.com/eclipse-edc/Connector</a>), an attacker might obtain OAuth2 client secrets from the vault.</div><div><br></div><div><p>In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component (<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/eclipse-edc/Connector\">https://github.com/eclipse-edc/Connector</a>) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.</p>\n<p>This feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.</p><br></div><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2024-05-07T13:11:45.310Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4536", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:40:47.492Z", "dateReserved": "2024-05-06T07:05:31.518Z", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "datePublished": "2024-05-07T13:11:45.310Z", "assignerShortName": "eclipse"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:edc_connector:*:*:*:*:*:*:*:*", "matchCriteriaId": "08F7DB6D-051E-4FC3-9213-D77CA98120E6", "versionEndExcluding": "0.6.3", "versionStartIncluding": "0.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault.\n\nIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.\n\nThis feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.\n\n"}, {"lang": "es", "value": "En los componentes de Eclipse Dataspace de la versi\u00f3n 0.2.1 a 0.6.2, en el componente EDC Connector (https://github.com/eclipse-edc/Connector), un atacante podr\u00eda obtener secretos del cliente OAuth2 de la b\u00f3veda. En los componentes de Eclipse Dataspace de la versi\u00f3n 0.2.1 a 0.6.2, hemos identificado una vulnerabilidad de seguridad en el componente EDC Connector (https://github.com/eclipse-edc/Connector) con respecto a la funci\u00f3n de receptor de datos protegido por OAuth2. Cuando se utiliza un receptor de datos personalizado protegido por OAuth2, el plano de datos del proveedor resuelve las propiedades de direcci\u00f3n de datos espec\u00edficas de OAuth2. Lo problem\u00e1tico es que la clientSecretKey proporcionada por el consumidor, que indica el secreto del cliente OAuth2 para recuperar de una b\u00f3veda de secretos, se resuelve en el contexto de la b\u00f3veda del proveedor, no en el del consumidor. Luego, el valor de este secreto se env\u00eda a tokenUrl, tambi\u00e9n controlado por el consumidor, como parte de una concesi\u00f3n de credenciales de cliente OAuth2. El token de acceso devuelto se env\u00eda luego como token de portador a la URL del receptor de datos. Esta caracter\u00edstica ahora est\u00e1 completamente deshabilitada porque no se implementaron completamente todas las rutas de c\u00f3digo necesarias para una realizaci\u00f3n exitosa."}], "id": "CVE-2024-4536", "lastModified": "2025-02-06T17:32:48.777", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.3, "source": "emo@eclipse.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 4.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-05-07T13:15:48.513", "references": [{"source": "emo@eclipse.org", "tags": ["Patch"], "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"}, {"source": "emo@eclipse.org", "tags": ["Release Notes"], "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"}, {"source": "emo@eclipse.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"}, {"source": "emo@eclipse.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/22"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}, {"lang": "en", "value": "CWE-522"}], "source": "emo@eclipse.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}