valtimo-platform valtimo-frontend-libraries up to 10.8.3/11.1.5/11.2.1 Header api.form.io x-jwt-token log file

Summaryinfo

A vulnerability has been found in valtimo-platform valtimo-frontend-libraries up to 10.8.3/11.1.5/11.2.1 and classified as problematic. Affected by this issue is the function api.form.io of the component Header Handler. This manipulation of the argument x-jwt-token causes log file. This vulnerability is handled as CVE-2024-34706. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in valtimo-platform valtimo-frontend-libraries up to 10.8.3/11.1.5/11.2.1 and classified as problematic. Affected by this vulnerability is the function api.form.io of the component Header Handler. The manipulation of the argument x-jwt-token with an unknown input leads to a log file vulnerability. The CWE definition for the vulnerability is CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. As an impact it is known to affect confidentiality. The summary by CVE is:

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is caused by a misconfiguration of the Form.io component. The following conditions have to be met in order to perform this attack: An attacker needs to have access to the network traffic on the `api.form.io` domain; the content of the `x-jwt-token` header is logged or otherwise available to the attacker; an attacker needs to have network access to the Valtimo API; and an attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes. Versions 10.8.4, 11.1.6 and 11.2.2 have been patched.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-34706 since 05/07/2024. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 10.8.4, 11.1.6 or 11.2.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• valtimo-platform

Name

• valtimo-frontend-libraries

Version

• 10.8.0
• 10.8.1
• 10.8.2
• 10.8.3
• 11.1.0
• 11.1.1
• 11.1.2
• 11.1.3
• 11.1.4
• 11.1.5
• 11.2.0
• 11.2.1

Website

• Product: https://github.com/valtimo-platform/valtimo-frontend-libraries/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion