JWT Claim Injection in Apache CXF

Executive Summary

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. This allows a client with a validly-signed JWT to substitute values like code_challenge, code_challenge_method, nonce, and state, which undermines PKCE integrity and OpenID Connect replay protection.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Apache CXF version is below 4.2.3, 4.1.8, or 3.6.12. Use commands like 'mvn dependency:tree' or 'java -jar cxf.jar version' to verify the installed version. Inspect JWT handling in logs for unexpected parameter substitutions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to bypass security protections like PKCE and replay protection, potentially gaining unauthorized access to user accounts or sensitive data. This is especially risky if client secrets are compromised or predictable.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Compliance may be compromised if user data is exposed due to weakened authentication protections.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Apache CXF to versions 4.2.3, 4.1.8, or 3.6.12 or later to address the vulnerability.

Useful 0 Not Useful 0