CVE-2024-4536 (published 2024-05-07T13:15Z)

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault.\n\nIn Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL.\n\nThis feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented.\n\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/eclipse-edc/Connector
commit_details: repo_url: https://github.com/eclipse-edc/Connector
author: Enrico Risa
author_date: 2024-05-03 07:49:42+02:00
msg: chore: removes OAuth2 capabilities from the data sink (#4152)

* chore: removes OAuth2 capabilities from the data sink

* pr remarks
repository: repo_url: https://github.com/eclipse-edc/Connector
repo_name: eclipse-edc/Connector
description: EDC core services including data plane and control plane
repo_language: Java
owner: eclipse-edc
file_changes: filename: DataPlaneHttpOauth2Extension.java
change_type: ModificationType.MODIFY
diff: @@ -58,7 +58,6 @@ public class DataPlaneHttpOauth2Extension implements ServiceExtension {
         var requestFactory = new Oauth2CredentialsRequestFactory(privateKeyResolver, clock, vault, context.getMonitor());
         var oauth2ParamsDecorator = new Oauth2HttpRequestParamsDecorator(requestFactory, oauth2Client);
 
-        paramsProvider.registerSinkDecorator(oauth2ParamsDecorator);
         paramsProvider.registerSourceDecorator(oauth2ParamsDecorator);
     }
 

programming_language: Java
filename: DataPlaneHttpOauth2ExtensionTest.java
change_type: ModificationType.ADD
diff: @@ -0,0 +1,47 @@
+/*
+ *  Copyright (c) 2024 Bayerische Motoren Werke Aktiengesellschaft (BMW AG)
+ *
+ *  This program and the accompanying materials are made available under the
+ *  terms of the Apache License, Version 2.0 which is available at
+ *  https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Contributors:
+ *       Bayerische Motoren Werke Aktiengesellschaft (BMW AG) - initial API and implementation
+ *
+ */
+
+package org.eclipse.edc.connector.dataplane.http.oauth2;
+
+import org.eclipse.edc.connector.dataplane.http.spi.HttpRequestParamsProvider;
+import org.eclipse.edc.junit.extensions.DependencyInjectionExtension;
+import org.eclipse.edc.spi.system.ServiceExtensionContext;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+
+import static org.mockito.ArgumentMatchers.isA;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+@ExtendWith(DependencyInjectionExtension.class)
+class DataPlaneHttpOauth2ExtensionTest {
+
+    private final HttpRequestParamsProvider paramsProvider = mock();
+
+    @BeforeEach
+    void setUp(ServiceExtensionContext context) {
+        context.registerService(HttpRequestParamsProvider.class, paramsProvider);
+    }
+
+    @Test
+    void verifyRegisterKafkaSource(DataPlaneHttpOauth2Extension extension, ServiceExtensionContext context) {
+        extension.initialize(context);
+
+        verify(paramsProvider).registerSourceDecorator(isA(Oauth2HttpRequestParamsDecorator.class));
+        verify(paramsProvider, never()).registerSinkDecorator(isA(Oauth2HttpRequestParamsDecorator.class));
+    }
+
+}

programming_language: Java