STS tokens can be obtained by using local APIs once the remote JWT token is presented, current code was not validating the incoming token in the first place and was incorrectly making a network operation using that token. For the most part this always works without issues, but under adversarial scenarios it exposes client to hand-craft a request that can reach internal services without authentication. This kind of proxying should be avoided before validating the incoming token.
Showing the changes to cmd/api-errors.go (1 of 2 files). Show all
Unified · Split
| @@ -2125,6 +2125,12 @@ func toAPIError(ctx context.Context, err error) APIError { · 2124 unmodified lines | ||
| 2125 | 2125 | HTTPStatusCode: e.Response().StatusCode, |
| 2126 | 2126 | } |
| 2127 | 2127 | // Add more Gateway SDKs here if any in future. |
| 2128 | + default: | |
| 2129 | + apiErr = APIError{ | |
| 2130 | + Code: apiErr.Code, | |
| 2131 | + Description: fmt.Sprintf("%s: cause(%v)", apiErr.Description, err), | |
| 2132 | + HTTPStatusCode: apiErr.HTTPStatusCode, | |
| 2133 | + } | |
| 2128 | 2134 | } |
| 2129 | 2135 | } |
| 2130 | 2136 | |