CVE-2024-1233: 
Java vulnerability analysis and mitigation

A flaw was found in JwtValidator.resolvePublicKey in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability. The vulnerability was discovered in February 2024 and affects JBoss Enterprise Application Platform (Red Hat CVE).

The vulnerability exists in the JwtValidator.resolvePublicKey component where the validator processes the jku (JSON Web Key Set URL) header in JWT tokens. When validating tokens, if the jku header is present, the system sends an HTTP request to the specified URL without proper URL filtering or whitelisting mechanisms. The vulnerability has been assigned a CVSS v3.1 base score of 7.3 (High severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (GitHub Advisory).

The SSRF vulnerability could allow attackers to make HTTP requests to arbitrary URLs through the affected system, potentially enabling unauthorized access to internal network resources and exposure of sensitive information. While the immediate impact might not directly compromise sensitive data or system integrity, it opens a pathway for attackers to discover and interact with internal services (Red Hat CVE).

The vulnerability requires an attacker to craft a malicious JWT token with a specially crafted jku header. The exploitation complexity is considered Low as it doesn't require special privileges or user interaction, though it does require some knowledge of JWT token manipulation (GitHub Advisory).

A mitigation has been implemented requiring that the jku header in a token must exactly match one of the values from a configured string of allowed values, or token validation will fail. The allowed jku values can be specified using the wildfly.elytron.jwt.allowed.jku.values. system property. For example, to set allowed jku values for JwtRealm, use the wildfly.elytron.jwt.allowed.jku.values.JwtRealm system property with a space-separated list of allowed URLs (WildFly Commit).