GHSA-789x-wph8-m68r: Lack of JWT issuer and signer validation in AWS ALB Route Directive Adapter for Istio

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: [awslabs/aws-alb-route-directive-adapter-for-istio] Lack of JWT issuer and signer validation - Publisher: zurowskik - Vulnerability ID: GHSA-789x-wph8-m68r - Release Date: 2 days ago 2. Affected Versions: - Affected Versions: 1.0, 1.1 - Fixed Versions: None 3. Severity: - Severity Level: High - CVSS Score: 7.5 / 10 4. Vulnerability Description: - The AWS ALB Route Directive Adapter for Istio repository provides an OIDC authentication mechanism using JWT, but lacks proper validation of the JWT signer and issuer. - In uncommon ALB deployments where endpoints are exposed to internet traffic, attackers can provide JWTs signed by untrusted entities to spoof OIDC authentication sessions and successfully bypass authentication. 5. Impact: - Affected versions: v1.0, v1.1 6. Patch: - The repository/package has been deprecated and has reached end-of-life; it is no longer actively supported. 7. Mitigation: - Ensure your ELB targets (e.g., EC2 instances, Fargate tasks, etc.) do not have public IP addresses. - Ensure any forked or derived code validates that the JWT's claim matches the ARN of the Application Load Balancer used in the service configuration. 8. References: - ALB documentation explicitly states that, for security, signatures must be validated before claim-based authorization, and the field in the JWT header must contain the expected Application Load Balancer ARN. - Python example 9. Contact Information: - For any questions or comments, please contact AWS/Amazon Security via the vulnerability reporting page or directly by email at aws-security@amazon.com. 10. Disclaimer: - Do not create public issues on GitHub.

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-789x-wph8-m68r: Lack of JWT issuer and signer validation in AWS ALB Route Directive Adapter for Istio

More from this source