Eclipse EDC up to 0.6.2 Connector insertion of sensitive information into sent data

Summaryinfo

A vulnerability identified as problematic has been detected in Eclipse EDC up to 0.6.2. This impacts an unknown function of the component Connector Component. Performing a manipulation results in insertion of sensitive information into sent data. This vulnerability is cataloged as CVE-2024-4536. The attack must originate from the local network. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Eclipse EDC up to 0.6.2. This affects some unknown functionality of the component Connector Component. The manipulation with an unknown input leads to a insertion of sensitive information into sent data vulnerability. CWE is classifying the issue as CWE-201. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL. This feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.

The weakness was shared by Sovity Gmbh as 22. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-4536 since 05/06/2024. The exploitability is told to be difficult. The attack can only be initiated within the local network. Additional levels of successful authentication are needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 0.6.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch a4e6018d2c0457fba6f672fafa6c590513c45d1b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Eclipse

Name

• EDC

Version

• 0.6.0
• 0.6.1
• 0.6.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion