Headline

GHSA-xcp4-62vj-cq3r: @valtimo/components exposes access token to form.io

Impact

When opening a form in Valtimo, the access token (JWT) of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user.

This issue is caused by a misconfiguration of the Form.io component.

Attack requirements

The following conditions have to be met in order to perform this attack:

An attacker needs to have access to the network traffic on the api.form.io domain.
The content of the x-jwt-token header is logged or otherwise available to the attacker.
An attacker needs to have network access to the Valtimo API.
An attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes.

Patches

Versions 10.8.4, 11.1.6 and 11.2.2 have been patched

6 months ago

ghsa

Open in Source

#vulnerability #nodejs #git

Navigation Menu

- Actions
  
  Automate any workflow
- Packages
  
  Host and manage packages
- Security
  
  Find and fix vulnerabilities
- Codespaces
  
  Instant dev environments
- Copilot
  
  Write better code with AI
- Code review
  
  Manage code changes
- Issues
  
  Plan and track work
- Discussions
  
  Collaborate outside of code

- GitHub Sponsors
  
  Fund open source developers

*   The ReadME Project
    
    GitHub community articles

Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

GitHub Advisory Database
GitHub Reviewed
CVE-2024-34706

@valtimo/components exposes access token to form.io

Package

npm @valtimo/components (npm)

Affected versions

< 10.8.4

>= 11.0.0, < 11.1.6

>= 11.2.0, < 11.2.2

Patched versions

10.8.4

11.1.6

11.2.2

Description

Impact

When opening a form in Valtimo, the access token (JWT) of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user.

This issue is caused by a misconfiguration of the Form.io component.

Attack requirements

The following conditions have to be met in order to perform this attack:

An attacker needs to have access to the network traffic on the api.form.io domain.
The content of the x-jwt-token header is logged or otherwise available to the attacker.
An attacker needs to have network access to the Valtimo API.
An attacker needs to act within the time-to-live of the access token. The default TTL in Keycloak is 5 minutes.

Patches

Versions 10.8.4, 11.1.6 and 11.2.2 have been patched

References