The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
The vulnerability mechanism results from the omission of 'aud' (Audience) field validation in JWT tokens by the JwtAccessTokenValidator class. The 'aud' field specifies which resource server the token was issued for. The lack of its verification means that a JWT token legitimately issued for one Resource Server can be successfully transmitted (replayed) to a completely different Resource Server and accepted there. This leads to a Token Confusion attack, in which authorization boundaries between different services are violated.
An attacker possessing a valid JWT token for one service can gain unauthorized access to other services (Resource Servers) in the same infrastructure. This can lead to breaches of confidentiality, integrity, and availability of protected resources.
Apache CXF should be updated to version 4.2.2 or 4.1.7, in which the issue has been fixed. Details are available in the vendor references on the Apache mailing list.
Apache CXF in versions prior to 4.2.2 and 4.1.7, using the JwtAccessTokenValidator class to validate JWT tokens.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HApache Cxf
APPApache< 4.1.74.2.0 – 4.2.2 (excl.)
Related vulnerabilities
Apache CXF: pominięcie walidacji tokenów OIDC umożliwia authentication bypass
Apache CXF: RCE przez niebezpieczną deserializację JMS ObjectMessage
Apache CXF: podmiana parametrów PKCE i OIDC przez JWT w JwtRequestCodeFilter
Apache CXF: brak walidacji scope w rejestracji klienta OAuth2
Apache CXF: wielokrotne użycie kodu autoryzacyjnego OAuth (CWE-294)