Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope claim of a token to escape the intended directory restriction. This occurs because the library normalizes both the authorized path (from the token) and the requested path (from the application) before comparing them using startswith. Details File: src/scitokens/scitokens.py Methods: checkscope, scopepathmatches File: src/scitokens/urltools.py Method: normalizepath Description When a token is verified, the Enforcer extracts the authorized path from the scope or scp claim. This path is passed through urltools.normalizepath, which uses posixpath.normpath to resolve relative segments. If a token has a scope like read:/home/user1/.., the normalization process converts this to /home. When the enforcer checks if a request for /home/user2 is authorized, it compares it against the normalized path /home. Vulnerable Logic Flow: 1. Normalization: In checkscope, the path…
Recommended action: Upgrade to 1.9.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. Details File: src/scitokens/scitokens.py Methods: validatescp and validatescope Vulnerable Code Snippets: In validatescp (around line 696): In validatescope (around line 722): If normpath (authorized) is /john and normrequestedpath (requested) is /johnathan, startswith returns True, incorrectly granting access. PoC Impact This bug allows a user to access resources they are not authorized for. For example, if a system uses usernames as top-level directories in a shared storage, a user john might be able to read or write to the directory of user johnathan simply because their names share a prefix.
Recommended action: Upgrade to 1.9.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (such as issuer and keyid). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. Ran the POC below locally. Details File: src/scitokens/utils/keycache.py Vulnerable Code Snippets 1. In addkeyinfo (around line 74): 2. In addkeyinfo (around lines 89 and 94): 3. In deletecacheentry (around line 128): 4. In addnegativecacheentry (around lines 148 and 152): 5. In getkeyinfo (around lines 193 and 198): PoC Impact An attacker who can influence the issuer or keyid (e.g., through a malicious token or issuer endpoint) could: 1. Modify or Delete Cache Entries: Clear the entire key cache or inject malicious keys. 2. Information Leakage: Query other tables or system information if SQLite is configured with certain extensions. 3. Potential RCE: In some configurations, SQLite can be used to achieve…
Recommended action: Upgrade to 1.9.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.