CVE-2024-47616: 
Linux openSUSE vulnerability analysis and mitigation

Pomerium, an identity and context-aware access proxy, disclosed a vulnerability (CVE-2024-47616) in its databroker service API authorization system. The vulnerability stems from incomplete validation of JSON Web Tokens (JWT) that could allow certain service account access tokens to be incorrectly treated as valid for databroker API authorization. This vulnerability affects Pomerium deployments that have issued service account access tokens using Pomerium Zero or Pomerium Enterprise, where the access token has an explicit future expiration date, and the core Pomerium databroker gRPC API is not secured by network access controls (GitHub Advisory).

The vulnerability exists in the databroker service, which manages all persistent Pomerium application state. The service relies on JWT validation for API authorization, where tokens are signed by a key shared among all Pomerium services in the same deployment. The security flaw arose from incomplete validation of these JWTs, specifically in cases involving service account access tokens. The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (Medium) with a vector string of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating network accessibility with high attack complexity, low privileges required, and potential for high impact on confidentiality and integrity (GitHub Advisory).

Exploitation of this vulnerability could lead to multiple security implications: exfiltration of user information, spoofing of user sessions, and unauthorized tampering with Pomerium routes, policies, and other settings. The impact is particularly significant for deployments where the databroker gRPC API is accessible and service account tokens are in use (GitHub Advisory).

The vulnerability has been fixed in Pomerium version 0.27.1. For deployments unable to upgrade immediately, recommended workarounds include implementing network access controls to restrict access to the Pomerium internal gRPC API and configuring firewalls to limit access to trusted sources only. Pomerium Zero deployments running version 0.26.0 or later can disable the gRPC API listener by setting grpc_address: "" in their YAML configuration file (GitHub Release, GitHub Advisory).