CVE-2024-4536 (Java, published 2024-05-07T13:15Z)
Description: value: In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault.

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.

This feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.


Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/eclipse-edc/Connector
Files changed:
extensions/data-plane/data-plane-http-oauth2-core/src/main/java/org/eclipse/edc/connector/dataplane/http/oauth2/DataPlaneHttpOauth2Extension.java
extensions/data-plane/data-plane-http-oauth2-core/src/test/java/org/eclipse/edc/connector/dataplane/http/oauth2/DataPlaneHttpOauth2ExtensionTest.java
Commit message: chore: removes OAuth2 capabilities from the data sink (#4152)

* chore: removes OAuth2 capabilities from the data sink

* pr remarks

Vulnerable code:
        paramsProvider.registerSinkDecorator(oauth2ParamsDecorator);

Fixed code:
/*
 *  Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG)
 *
 *  This program and the accompanying materials are made available under the
 *  terms of the Apache License, Version 2.0 which is available at
 *  https://www.apache.org/licenses/LICENSE-2.0
 *
 *  SPDX-License-Identifier: Apache-2.0
 *
 *  Contributors:
 *       Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation
 *
 */

package org.eclipse.edc.connector.dataplane.http.oauth2;

import org.eclipse.edc.connector.dataplane.http.spi.HttpRequestParamsProvider;
import org.eclipse.edc.junit.extensions.DependencyInjectionExtension;
import org.eclipse.edc.spi.system.ServiceExtensionContext;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;

import static org.mockito.ArgumentMatchers.isA;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.verify;

@ExtendWith(DependencyInjectionExtension.class)
class DataPlaneHttpOauth2ExtensionTest {

    private final HttpRequestParamsProvider paramsProvider = mock();

    @BeforeEach
    void setUp(ServiceExtensionContext context) {
        context.registerService(HttpRequestParamsProvider.class, paramsProvider);
    }

    @Test
    void verifyRegisterKafkaSource(DataPlaneHttpOauth2Extension extension, ServiceExtensionContext context) {
        extension.initialize(context);

        verify(paramsProvider).registerSourceDecorator(isA(Oauth2HttpRequestParamsDecorator.class));
        verify(paramsProvider, never()).registerSinkDecorator(isA(Oauth2HttpRequestParamsDecorator.class));
    }

}