Token Validity Bypass in Eclipse Dataspace Components

CVE-2024-8642

Summary

A security vulnerability exists in the ConsumerPullTransferTokenValidationApiController of Eclipse Dataspace Components. Versions prior to 0.9.0 allow attackers to bypass token expiration checks due to inadequate validation of token attributes such as expiry, not-before, and issuance dates. This flaw requires a specific configuration: a dataplane setup that supports HTTP proxy consumer pull and includes the 'transfer-data-plane' module. Although the vulnerable code was deprecated in version 0.6.0, it has been completely removed in version 0.9.0, enhancing the security posture of the product.

References