Pascal Knoth

**Name of the Vulnerable Software and Affected Versions** boruta versions 2.3.0 through 2.3.6 **Description** An authentication bypass exists allowing an attacker to authenticate as an OAuth client using a previously valid but expired JWT client assertion. The software accepts `client secret jwt` and `private key jwt` authentication methods at the token endpoint but fails to verify that the `exp` claim is in the future. Specifically, the `check expiration/1` function in `Boruta.Oauth.Request.Base` only checks for the presence of the `exp` claim, and the `token config/0` function in `Boruta.Oauth.Authorization.Client.Token` returns an empty map, bypassing the default expiration validator. An attacker who obtains a signed client assertion through logs or proxies can replay it indefinitely to obtain access tokens with the client's privileges. **Recommendations** Update boruta to version 2.3.7 or later. Restrict the use of `client secret jwt` and `private key jwt` authentication to highly trusted clients. Prefer non-JWT authentication methods such as `client secret basic` or `client secret post`. Issue short-lived client assertions and protect them from exposure in application logs, fronting proxies, browser tooling, and observability systems.

**Name of the Vulnerable Software and Affected Versions** malach-it Boruta versions 2.3.2 through 2.3.6 **Description** An unauthenticated remote attacker can cause the OAuth/OpenID authorization server to issue outbound HTTP requests to arbitrary URIs, including internal services and cloud metadata endpoints. This occurs because three code paths fetch remote URIs supplied by the requester without sufficient validation. Specifically, the `fetch unsigned request/1` function dereferences the `request uri` parameter, the `parse registration params/2` function dereferences the `jwks uri` supplied in an OpenID Connect dynamic client registration request, and the `refresh jwk from jwks uri/1` function refreshes the stored `jwks uri` for an existing client. The validation is insufficient as it only checks if the URI parses with a scheme, failing to require HTTPS, enforce host or IP allowlists, reject loopback or private IP ranges after DNS resolution, cap response size, or constrain redirects. **Recommendations** Update malach-it Boruta to version 2.3.7 or later. Restrict the network egress of the Boruta host to prevent the OAuth/OpenID authorization server from reaching loopback, private, link-local, multicast, or cloud metadata addresses. Disable application routes for OAuth `request uri` dereferencing and OpenID Connect dynamic client registration, or restrict dynamic client registration to trusted callers.

**Name of the Vulnerable Software and Affected Versions** boruta versions 2.3.0 through 2.3.6 **Description** Improper Isolation or Compartmentalization in the `Elixir.Boruta.Openid` module allows unauthenticated attackers to register OpenID Connect clients with administrative privileges via the dynamic client registration entry point. The function `register client/3` forwards caller-supplied parameters to the administrative client creation path without a field-level allowlist. This enables attackers to set security-sensitive attributes, such as supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The issue is also associated with the `parse registration params/2` function. The flaw exists because the library fails to distinguish between metadata a public registrant can set and administrative controls requiring operator approval. **Recommendations** Update boruta to version 2.3.7. Disable the dynamic client registration route or restrict it to authenticated administrators. If dynamic registration must remain available to untrusted callers, avoid forwarding request parameters to `register client/3` directly; instead, construct a parameter map containing only standards-defined public metadata and overwrite administrative attributes with fixed least-privilege server-side profile values before calling the function.