JWT Signature Validation Vulnerability in Amazon ALB

CVE-2024-10125

What is CVE-2024-10125?

A vulnerability in the Amazon Application Load Balancer's integration with the ASP.NET Core framework could potentially expose deployments to risks associated with improper validation of JWT tokens. The middleware responsible for handling JWT signature validation does not adequately assess the issuer and signer identity. This oversight could allow an untrusted entity to produce valid JWT tokens, particularly in scenarios where the Application Load Balancer targets are accessible over the internet. As a precaution, it is advised to ensure that all ELB targets do not possess public IP addresses and to verify that any derivative code appropriately checks the signer attribute against the ALB's ARN. The affected middleware has been deprecated and is no longer supported, emphasizing the need for robust security practices in OIDC-federated sessions.

References