rootvector2 opened a new pull request, #3636: URL: https://github.com/apache/cxf/pull/3636
`JWTTokenValidator.validateToken` passes the received token's own JOSE headers to `JwsUtils.loadSignatureVerifier`, so an `x5t`, `x5t#S256` or `x5c` header picks the verification certificate from any alias in the STS signature keystore (which is also its trust store and holds the trusted client certificates, see `stsstore.jks`) instead of the configured `signatureUsername` alias, letting any holder of a certificate the STS trusts sign a JWT with `sub=admin` that validates as issued by the STS; found while reviewing the STS token validators, reproduced by the new `testTokenSignedByTrustedCertificate` (passes as VALID on the unpatched tree), and fixed by loading the verifier without the token headers so only the STS signing certificate is used, which changes nothing for STS-issued tokens since they carry only `alg`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
