Description
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat build of Quarkus 3.27.5.SP2
Default version status: unaffected
Red Hat Red Hat build of Quarkus 3.33.3.SP2
Default version status: unaffected
Red Hat Exploit Intelligence
Default version status: affected
Red Hat Red Hat build of Apicurio Registry 3
Default version status: affected
Red Hat Red Hat build of Apicurio Registry 3
Default version status: unknown
Red Hat Red Hat build of Quarkus
Default version status: affected
Red Hat Red Hat JBoss Enterprise Application Platform 8
Default version status: affected
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
Default version status: affected