THREAT OPS › Threat News › [GHSA] GHSA-8cp3-qxj6-px34 (high) — utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
[GHSA] GHSA-8cp3-qxj6-px34 (high) — utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
GHSA-8cp3-qxj6-px34 Severity: high CVE: None
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
### Summary
The `utcp-http` library (<= 1.1.3) unconditionally trusts the `tokenUrl` field embedded in remote OpenAPI security schemes. When a victim registers an attacker-controlled OpenAPI spec and invokes any generated OAuth2-protected tool, the library POSTs the victim
MITRE ATT&CK techniques
Indicators of compromise
- http://127.0.0.1:7777/tokenurl
- http://127.0.0.1:8888/openapi.jsonurl
- http://169.254.169.254/url
- http://127.0.0.1:{TOOL_PORT}url
- http://127.0.0.1:{TOKEN_PORT}/tokenurl
- http://127.0.0.1:{SPEC_PORT}/openapi.jsonurl
- http://127.0.0.1:{TOOL_PORT}/demourl
Original source: https://github.com/advisories/GHSA-8cp3-qxj6-px34