CyberRota Analysis
AI-GeneratedThe vulnerability exists in the `POST /v1/upload/sbom` endpoint of PIA, where the unverified `iss` claim in a Bearer JWT is improperly validated against an allowlist, allowing an attacker to manipulate the issuer to bypass checks. This flaw can lead to unauthorized access to sensitive data by redirecting requests to an arbitrary host for JWKS retrieval, potentially compromising the integrity of the application. Organizations utilizing this endpoint should prioritize patching this vulnerability to mitigate risks associated with unauthorized data exposure and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash (e.g. `https://attacker-host\@ci.eclipse.org/`) into *different* hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` — and subsequently `urllib.request.urlopen` for JWKS retrieval — to connect to an arbitrary attacker-chosen host, port, and scheme.