github/distribution
1
0
Fork 0
mirror of https://github.com/distribution/distribution.git synced 2025-09-13 13:49:00 +00:00
Code Issues Projects Releases Wiki Activity

Fix registry token authentication bug

Browse Source 
When a JWT contains a JWK header without a certificate chain,
the original code only checked if the KeyID (kid) matches one of the trusted keys,
but doesn't verify that the actual key material matches.

As a result, if an attacker guesses the kid, they can inject an
untrusted key which would then be used to grant access to protected
data.

This fixes the issue such as only the trusted key is verified.

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
This commit is contained in:
Milos Gajdos
2025-02-01 15:30:18 -08:00
parent 7271d882c0
commit f4a500caf6
2 changed files with 57 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
registry/auth/token/token.go
View File

@@ -219,11 +219,12 @@ func verifyJWK(header jose.Header, verifyOpts VerifyOptions) (signingKey crypto.
// Check to see if the key includes a certificate chain.
if len(jwk.Certificates) == 0 {
// The JWK should be one of the trusted root keys.
if _, trusted := verifyOpts.TrustedKeys[jwk.KeyID]; !trusted {
trustedKey, trusted := verifyOpts.TrustedKeys[jwk.KeyID]
if !trusted {
return nil, errors.New("untrusted JWK with no certificate chain")
}
// The JWK is one of the trusted keys.
return
return trustedKey, nil
}
opts := x509.VerifyOptions{