CVE-2024-4536
📋 TL;DR
This vulnerability allows attackers to obtain OAuth2 client secrets from the vault in Eclipse Dataspace Components. It affects users of the EDC Connector component who use custom OAuth2-protected data sinks. The vulnerability occurs because client secrets are resolved in the provider's vault context instead of the consumer's, potentially exposing sensitive credentials.
💻 Affected Systems
- Eclipse Dataspace Components EDC Connector
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal OAuth2 client secrets, potentially gaining unauthorized access to protected data sinks and sensitive systems that rely on those credentials.
Likely Case
Exposure of OAuth2 client secrets that could be used to impersonate legitimate clients and access protected resources.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to vulnerable components.
🎯 Exploit Status
Exploitation requires understanding of the OAuth2-protected data sink feature and access to the vulnerable component.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.6.3
Vendor Advisory: https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3
Restart Required: Yes
Instructions:
1. Update Eclipse Dataspace Components to version 0.6.3 or later. 2. Restart the EDC Connector service. 3. Verify the OAuth2-protected data sink feature is disabled.
🔧 Temporary Workarounds
Disable OAuth2-protected data sink feature
allManually disable the vulnerable OAuth2-protected data sink feature if unable to patch immediately.
# Configuration depends on deployment method. Check EDC Connector documentation for feature flags.
🧯 If You Can't Patch
- Implement network segmentation to isolate EDC Connector components from untrusted networks.
- Monitor for unusual OAuth2 token requests and access patterns to affected data sinks.
🔍 How to Verify
Check if Vulnerable:
Check if using Eclipse Dataspace Components EDC Connector version between 0.2.1 and 0.6.2 with OAuth2-protected data sinks enabled.Check Version:
# For container deployments: docker inspect <container> | grep -i version
# For source deployments: check pom.xml or build.gradle versionVerify Fix Applied:
Verify version is 0.6.3 or later and confirm OAuth2-protected data sink feature is disabled.📡 Detection & Monitoring
Log Indicators:
- Unusual OAuth2 token requests from EDC Connector
- Failed or unexpected vault secret retrievals
Network Indicators:
- Unexpected traffic to OAuth2 token endpoints from EDC Connector
- Unusual bearer token usage patterns
SIEM Query:
source="edc-connector" AND (event="oauth2_token_request" OR event="vault_secret_access")🔗 References
- https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b
- https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3
- https://gitlab.eclipse.org/security/cve-assignement/-/issues/22
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198
- https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b
- https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3
- https://gitlab.eclipse.org/security/cve-assignement/-/issues/22
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198
