Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical authentication bypass vulnerability in the malach-it Boruta library, which is used for handling OAuth client authentication. The flaw allows an attacker to reuse a previously valid, but expired, security token to impersonate an OAuth client and gain unauthorized access to resources. The main concern is confirming relevance and exposure within your environment.
- Replay of expired security tokens.
- Critical for systems handling client authentication.
- Confirm if your environment uses this library.
Attack Path
How an attacker could exploit the issue
An attacker can impersonate an OAuth client by reusing an expired JWT client assertion. This is possible because the system does not properly validate the expiration date of JWTs used for client authentication. If an attacker gains access to a valid, but expired, JWT, they can replay it to authenticate as the legitimate client and receive access tokens with that client's permissions.
- Requires obtaining a valid, expired JWT.
- Triggers by replaying the JWT.
- Results in client impersonation and unauthorized access.
Live Threat
Current exploitation, exposure, and threat context
An attacker who obtains a previously valid JWT client assertion could replay it to authenticate as the issuing OAuth client. This could allow them to obtain access tokens with that client's privileges, even after the assertion has expired.
- Client assertion data could be exposed.
- Replay attacks could bypass authentication.
- Unauthorized access to client resources may occur.
Operational Fix
Recommended remediation, mitigation, and detection steps
The security of the Boruta OAuth2/OIDC provider library is critical, as an authentication bypass vulnerability could allow attackers to impersonate legitimate clients and gain unauthorized access. System owners and platform teams are likely responsible for managing Boruta deployments. The immediate priority is to inventory all Boruta instances, assess their exposure and business criticality, identify the accountable application or platform owner, and then plan remediation based on the identified risk.
- Identify and catalog all Boruta instances.
- Confirm reachability and business criticality.
- Plan remediation with accountable owners.
