Steeltoe Security CVE-2025-8188: Missing Private Key Possession Proof in Cert Auth

Vulnerability Summary Vulnerability Overview Title: Header-forwarded client cert lacks proof of private-key possession Severity: Moderate, CVSS 3.1 Score 6.5/10 Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality Impact: High Integrity Impact: Low Availability Impact: None CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVE ID: CVE-2025-8188 Related Weaknesses: CWE-288, CWE-295 Affected Scope Affected Package: (NuGet) Affected Versions: <= 4.2.0 Fixed Version: 4.3.0 Impact Description: When certificate-based authorization ( ) is configured in Steeltoe, the middleware relies on the request header to identify client certificates under default configuration, but does not verify proof of private-key possession. This header is not stripped by common Cloud Foundry routers (such as Gorouter or Envoy) in incoming requests. An attacker who obtains the public key certificate for an application instance in a target organization/space can forge the request header, thereby bypassing SAS-based authorization policies and gaining unauthorized access to protected endpoints for the duration of the certificate’s validity period. Remediation If immediate upgrade to the fixed version is not possible, the following mitigations can be applied: Restrict to trusted proxy source IPs using and . Change the forwarded request header to so that Cloud Foundry Gorouter and Envoy header-stripping mechanisms will remove it. Add a second layer of authorization for sensitive endpoints (e.g., a proxy layer based on shared secrets or mTLS). Ensure applications are not bound to public routes; use Cloud Foundry internal routes (such as ) and container-to-container network policies to strictly restrict access to internal clients. POC / Exploit Code This page does not include POC code or an exploit code block.

Goal Reached Thanks to every supporter — we hit 100%!

Steeltoe Security CVE-2025-8188: Missing Private Key Possession Proof in Cert Auth

More from this source