CVE-2021-32701: 
NixOS vulnerability analysis and mitigation

ORY Oathkeeper, an Identity & Access Proxy (IAP) and Access Control Decision API, was found to have a security vulnerability in versions v0.38.0-beta.2 through v0.38.11-beta.1. The vulnerability allows for bypassing token claim validation when OAuth2 Introspection caching is enabled. This issue was discovered in June 2021 and was assigned CVE-2021-32701 (GitHub Advisory).

The vulnerability occurs when making a request to an endpoint that requires a specific scope (e.g., 'foo') using an access token granted with that scope. The introspection result is cached. If a subsequent request is made to an endpoint requiring a different scope (e.g., 'bar') before the cache expires, the introspection will be considered valid regardless of whether the token has the required 'bar' scope. The issue stems from the cache only validating the token expiration date while ignoring scope validation (GitHub Advisory).

This vulnerability could allow attackers to bypass scope validation checks and access endpoints for which they don't have the required permissions, potentially leading to unauthorized access to protected resources (GitHub Advisory).

The vulnerability can be exploited by making sequential requests with a valid token to different endpoints with different scope requirements before the cache expires. The attack requires a valid token with at least one legitimate scope to initiate the exploit (GitHub Advisory).

The vulnerability was patched in version v0.38.12-beta.1. For users unable to upgrade immediately, a workaround exists: caching is disabled by default for the oauth2_introspection authenticator, and when caching is disabled, this vulnerability does not exist. The development team has also implemented additional security measures including strict code coverage requirements and CodeQL scanning in CI to prevent similar issues (GitHub Advisory).