GHSA-3x2w-63fp-3qvw

Summary

The Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope claim of a token to escape the intended directory restriction. This occurs because the library normalizes both the authorized path (from the token) and the requested path (from the application) before comparing them using startswith.

Details

File: src/scitokens/scitokens.py
Methods: _check_scope, _scope_path_matches
File: src/scitokens/urltools.py
Method: normalize_path

Description

When a token is verified, the Enforcer extracts the authorized path from the scope or scp claim. This path is passed through urltools.normalize_path, which uses posixpath.normpath to resolve relative segments.

If a token has a scope like read:/home/user1/.., the normalization process converts this to /home. When the enforcer checks if a request for /home/user2 is authorized, it compares it against the normalized path /home.

Vulnerable Logic Flow:

1. Normalization: In _check_scope, the path /home/user1/.. is normalized to /home.
2. Comparison: In _scope_path_matches, the requested path /home/user2 is checked against the allowed path /home:

   return requested_path.startswith(allowed_path + '/')
   # "/home/user2".startswith("/home/") is True
   

Bypassing with URL Encoding:

Since normalize_path unquotes the path before normalizing, an attacker can also use URL-encoded dots (e.g., %2e%2e) to hide the traversal from simple string filters that don't account for encoding.

Root Traversal:

A scope like read:/anything/.. normalizes to read:/, which grants access to the entire file system (or whatever resource space the enforcer is guarding).

Impact

An attacker who can influence the scope claim (e.g., in environments where tokens are issued with user-provided sub-paths) can gain access to directories and files outside of their intended...