<!-- This ticket is confidential. --> # CVE Reservation Request ## CVE record information **Project name:** Eclipse ioFog **Project id:** iot.iofog **Versions affected:** [3.8.0, 3.9.1] Confirmed on v3.9.1. The same operator WebSocket path shipped in the v3.8.0 greenfield release and is still present in v3.9.1. v3.7 and earlier were not part of this review. **Common Weakness Enumeration (CWE):** - [CWE-347: Improper Verification of Cryptographic Signature](https://cwe.mitre.org/data/definitions/347.html) **Common Attack Pattern Enumerations and Classifications (CAPEC):** - [CAPEC-115: Authentication Bypass](https://capec.mitre.org/data/definitions/115.html) **Common Vulnerability Scoring System:** [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (base 9.8) A running microservice or fog UUID is still required to open a session. REST rejects the same forged token. Please rescore if you treat that UUID as higher attack complexity. **Summary:** In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected. **Links:** - https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1270 - https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1269 (duplicate of 1270) - https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1267 (duplicate of 1270) No public fix commit yet. The fix is under embargo and the link will be added when v3.9.2 is released, before publication. **Credits:** Eclipse Foundation Security Team