Apache CXF OAuth2 JWT Audience Validation Issue: Early Warning
- Severity
- HIGH
- Affected component
- org.apache.cxf:cxf-rt-rs-security-oauth2 (maven)
- Affected versions
- >= 4.2.0, < 4.2.2 or < 4.1.7
- Patched version
- 4.2.2, 4.1.7
An early warning has been issued regarding a high severity issue in Apache CXF OAuth2 JWT Audience Validation. Users of affected versions of org.apache.cxf:cxf-rt-rs-security-oauth2 are advised to upgrade.
What happened
An early warning has been issued for a vulnerability in the JwtAccessTokenValidator class of Apache CXF. This class reportedly fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This oversight allows a JWT issued for one Resource Server to be replayed against a different Resource Server, leading to potential Token Confusion/Routing attacks. The issue is under investigation and has not yet been exploited in the wild.
The affected component is org.apache.cxf:cxf-rt-rs-security-oauth2. Versions affected are those greater than or equal to 4.2.0 but less than 4.2.2 or less than 4.1.7. Users of these versions should assess their exposure and consider upgrading as recommended.
What to do about it
- Upgrade to versions 4.2.2 or 4.1.7 of org.apache.cxf:cxf-rt-rs-security-oauth2 to mitigate the risk.
- Review your application's use of JWT tokens and ensure proper validation of 'aud' claims.
- Monitor the primary sources for updates on this issue.
- Consider implementing additional security measures to protect against Token Confusion/Routing attacks.
How 0Day would have caught this
org.apache.cxf:cxf-rt-rs-security-oauth2 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using org.apache.cxf:cxf-rt-rs-security-oauth2 in versions greater than or equal to 4.2.0 but less than 4.2.2 or less than 4.1.7.
What should I do right now?
Upgrade to versions 4.2.2 or 4.1.7 of org.apache.cxf:cxf-rt-rs-security-oauth2.
Is there an official fix available?
Yes, versions 4.2.2 and 4.1.7 are recommended as patched versions.
Should I be concerned about exploitation in the wild?
There is no confirmed exploitation in the wild at this time. However, it is advisable to upgrade to a patched version as a precaution.