Steeltoe.Security.Authorization.Certificate deployments before version 4.3.0 that use AddOrgAndSpacePolicies() and UseCertificateAuthorization() trust the public certificate presented in the X-Client-Cert HTTP request header without verifying that the client possesses the corresponding private key. Since common Cloud Foundry routers do not remove this header from inbound requests, an attacker who obtains the public certificate of an application instance within the target organization or space and can reach the application can spoof the X-Client-Cert header. This allows bypassing SameOrg and SameSpace authorization policies for the certificate's validity period. The vulnerability is addressed in Steeltoe version 4.3.0.

An attacker who can send requests to the affected application and spoof the X-Client-Cert header can bypass authorization policies that rely on certificate validation, specifically SameOrg and SameSpace policies. This could lead to unauthorized access to resources within the affected organization or space. The confidentiality impact is high, integrity impact is low, and availability is not affected.

Upgrade Steeltoe.Security.Authorization.Certificate to version 4.3.0 or later, where this vulnerability is fixed. Until then, restrict inbound requests to trusted proxy source IPs to prevent attackers from spoofing the X-Client-Cert header. Verify that the application properly validates possession of the private key corresponding to the public certificate in the X-Client-Cert header.