-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/octo-sts/app | go | <= 0.5.2 | 0.5.3 |
Miggo AIRoot Cause AnalysisThe vulnerability is an unauthenticated SSRF in Octo-STS, which can be exploited by sending a malicious OpenID Connect token. The patches address this by adding input validation and redacting sensitive information from logs. The analysis of the commits reveals that the Exchange function in pkg/octosts/octosts.go, the CheckToken function in pkg/octosts/trust_policy.go, and the Get function in pkg/provider/provider.go were all processing the OIDC token without proper validation, making them vulnerable to SSRF. The new functions in pkg/oidcvalidate/validate.go are the mitigation, not the vulnerability. The Exchange function is the main entry point for processing the token and is therefore the primary vulnerable function. The CheckToken function also processes the token and is vulnerable. The Get function was vulnerable to SSRF during OIDC discovery.
Ongoing coverage of React2Shell