A flaw was found in `JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends an HTTP request. During this process, no whitelisting or filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.3 | CVE-2024-1233 |
Exploitation
To exploit this vulnerability, an attacker can manipulate the `jku` parameter in the JWT token to point to a malicious server. When the `JwtValidator.resolvePublicKey` method is called, it will send an HTTP request to the specified URL without any validation, allowing the attacker to perform SSRF attacks.
Affected Products
- JBoss EAP: Affected versions of JBoss EAP may allow unauthorized access to internal services through SSRF due to improper validation of the `jku` parameter.
Mitigation
To mitigate this vulnerability, it is recommended to implement proper whitelisting and filtering of URLs in the `JwtValidator.resolvePublicKey` method. Additionally, users should update to the latest version of JBoss EAP where this issue has been addressed.