CVE-2024-34706
📋 TL;DR
This vulnerability exposes user access tokens (JWTs) to the api.form.io domain when opening forms in Valtimo, allowing attackers to steal tokens and impersonate users. Attackers can retrieve personal information or execute API requests as the compromised user. Organizations using unpatched Valtimo versions with the Form.io component are affected.
💻 Affected Systems
- Valtimo business process and case management platform
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, unauthorized access to sensitive business data, privilege escalation, and potential data exfiltration from the Valtimo platform.
Likely Case
Unauthorized access to user-specific data and limited API operations within the token's 5-minute TTL window.
If Mitigated
Limited impact with proper network segmentation, token monitoring, and short TTLs, though token exposure remains a concern.
🎯 Exploit Status
Exploitation requires network access to api.form.io traffic and token interception within 5-minute TTL
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.8.4, 11.1.6, or 11.2.2
Vendor Advisory: https://github.com/valtimo-platform/valtimo-frontend-libraries/security/advisories/GHSA-xcp4-62vj-cq3r
Restart Required: Yes
Instructions:
1. Update Valtimo to version 10.8.4, 11.1.6, or 11.2.2. 2. Apply the security patches from the GitHub commits. 3. Restart the Valtimo application.
🔧 Temporary Workarounds
Network segmentation for api.form.io
allRestrict network access to the api.form.io domain to prevent token interception
Reduce JWT TTL
allDecrease the access token time-to-live to minimize exposure window
keycloak config update --realm <realm> --access-token-lifespan 60
🧯 If You Can't Patch
- Implement strict network monitoring for traffic to api.form.io domain
- Enable detailed logging of all JWT token usage and monitor for suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check if Valtimo version is below 10.8.4, 11.1.6, or 11.2.2 and inspect network traffic for x-jwt-token headers sent to api.form.ioCheck Version:
Check Valtimo application configuration or package.json for version informationVerify Fix Applied:
Confirm Valtimo is updated to patched version and verify x-jwt-token headers are no longer sent to api.form.io📡 Detection & Monitoring
Log Indicators:
- Unusual API requests with valid JWTs from unexpected sources
- Multiple failed authentication attempts followed by successful token usage
Network Indicators:
- Traffic to api.form.io containing x-jwt-token headers
- Unusual outbound connections from Valtimo instances
SIEM Query:
source="valtimo" AND (http.header="x-jwt-token" OR destination="api.form.io")🔗 References
- https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/1aaba5ef5750dafebbc7476fb08bf2375a25f19e
- https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/8c2dbf2a41180d2b0358d878290e4d37168f0fb6
- https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/d65e05fd2784bd4a628778b34a5b79ce2f0cef8c
- https://github.com/valtimo-platform/valtimo-frontend-libraries/security/advisories/GHSA-xcp4-62vj-cq3r
- https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/1aaba5ef5750dafebbc7476fb08bf2375a25f19e
- https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/8c2dbf2a41180d2b0358d878290e4d37168f0fb6
- https://github.com/valtimo-platform/valtimo-frontend-libraries/commit/d65e05fd2784bd4a628778b34a5b79ce2f0cef8c
- https://github.com/valtimo-platform/valtimo-frontend-libraries/security/advisories/GHSA-xcp4-62vj-cq3r
