mirror of
https://github.com/zitadel/zitadel.git
synced 2025-07-11 22:38:31 +00:00
4fde7822d8
# Which Problems Are Solved ZITADEL allows the use of JSON Web Token (JWT) Profile OAuth 2.0 for Authorization Grants in machine-to-machine (M2M) authentication. Multiple keys can be managed for a single machine account (service user), each with an individual expiry. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker with an expired key to obtain valid access tokens. This vulnerability does not affect the use of JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspection endpoints, which correctly reject expired keys. # How the Problems Are Solved Added proper validation of the expiry of the stored public key. # Additional Changes None # Additional Context None (cherry picked from commit 315503beabd679f2e6aec0c004f0f9d2f5b53ed3)
13 lines
394 B
SQL
13 lines
394 B
SQL
select u.id as user_id, u.resource_owner, u.username, m.access_token_type, k.public_key
|
|
from projections.authn_keys2 k
|
|
join projections.users14 u
|
|
on k.instance_id = u.instance_id
|
|
and k.identifier = u.id
|
|
join projections.users14_machines m
|
|
on u.instance_id = m.instance_id
|
|
and u.id = m.user_id
|
|
where k.instance_id = $1
|
|
and k.id = $2
|
|
and u.id = $3
|
|
and k.expiration > current_timestamp;
|