JWT Audience Claim is not Verified

[bigkevmcd]

Report

This section to be completed to report a potential vulnerability.

Describe

We aren't verifying the aud claim from the JWT token.

References

https://github.com/argoproj/argo-cd/security/advisories/GHSA-q9hr-j4rf-8fjc

Handling

If you are reporting a potential vulnerability, you could ignore this section. It is intended to be managed by a Vulnerability Manager

• [x] Reporter notifies Weaveworks team (Receiver) about a potential vulnerability via any of the Security Vulnerability Sources. Receiver acknowledges it. If likely to be a legitimate request, Receiver creates a private issue of type CVE in https://github.com/weaveworks/weave-gitops-private to start the formal intake.
• [x] Vulnerability Manager triages the request to either accept or rejects it:
• [x] In case of accepted, Vulnerability Manager starts the coordination of the vulnerability based on the created issue. The vulnerability is treated as highest priority and directed to the respective Product Team.
• [x] In case of rejected, if needed, a response to Reporter is provided about the rejection and the process terminates.
• [x] Product Team evaluates the vulnerability with help from Vulnerability Manager. The evaluation should include which products and versions are affected.
• [x] If the vulnerability does not pose a threat to the product or service, Vulnerability Manager responds back to the Reporter with proper reasoning.
• [x] If the reported request is considered a vulnerability, Vulnerability Manager responds back to the Reporter, accepting the issue. Vulnerability Manager communicates and coordinates to the rest of internal stakeholders. Vulnerability Manager engages with CX to start the discovery of customers being affected.
• [ ] Product team provides a workaround, Vulnerability Manager makes it available to the Reporter and notifies CX. CX manages with customers the workaround.
• [ ] Product Team works to identify a fix and produce a time estimation (ETA) to create the fix for the product or service.
• [ ] Vulnerability Manager adds a 4 weeks buffer to the ETA. This date becomes the public announcement date.
• [ ] Vulnerability Manager e notifies the Reporter of the public announcement date. Vulnerability Manager asks the Reporter if they want to be credited. A Public Security Advisory will be issued accordingly.
• [ ] Vulnerability Manager creates a Private Security Advisory for the vulnerability, including the impact, and any available mitigations. It would be created using this template. An example of a Security Advisory is CVE-1126.
• [ ] CX would announce with customers the vulnerability sharing the Security Advisory.
• [ ] Product Team delivers the fix and communicates to Vulnerability Manager. Vulnerability Manager provides it to the Reporter and all affected customers via CX. CX manages the application of the fix on the customer side.
• [ ] A Public Security Advisory will be issued after all the fixes are issued to the customers and the public announcement date has been reached.

[lizwarner-weave]

@souleb please note that @mestadler has nominated you as Vulnerability Manager on this one. Slack thread with context for ya: https://weaveworks.slack.com/archives/CLNECSKPD/p1675269116678369?thread_ts=1675177301.542889&cid=CLNECSKPD

[bigkevmcd]

We were delegating to go-oidc for this, so we weren't vulnerable to the same issue.