Threat Intelligence Database

Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Apache Syncope versions 3.0.15 through 3.0.16, 4.0.3 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a vulnerability where sensitive information, specifically the AES key after padding, is inserted into log files. This occurs when a non-standard length AES key is configured, causing Syncope to pad the key with random characters and log the resulting value. Upgrading to versions 4.0.8 or 4.1.3 addresses this issue.

Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an authentication bypass vulnerability due to spoofing. This occurs when JWKS settings for internal JWT authentication are disclosed, allowing an attacker who has authenticated successfully and obtained a valid JWT to spoof another user's privileges. Upgrading to versions 4.0.8 or 4.1.3 resolves this issue.

Apache Syncope contains an improper isolation vulnerability allowing an administrator with Implementation entitlements to create malicious Groovy classes that bypass the Groovy security sandbox. This affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The issue is fixed in versions 4.0.7 and 4.1.2 by tightening the Groovy sandbox.

Apache Syncope versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 contain an improper isolation vulnerability. An administrator with sufficient privileges can create malicious Groovy code that executes outside the intended sandbox, including static initializers. This can lead to unauthorized code execution with high impact on confidentiality, integrity, and availability. Fixed versions 4.0.6 and 4.1.1 enforce sandboxing even for static initializers in Groovy code.