Octo STS 未认证 SSRF 通过滥用 OpenID Connect token 中的字段 (github.com/octo-sts/app)

该SSRF漏洞的潜在影响非常严重。攻击者可以利用该漏洞扫描内部网络，访问内部服务，甚至可能执行未经授权的操作。攻击者可以通过构造恶意的OpenID Connect令牌，将请求伪装成来自受信任来源的请求，从而绕过身份验证机制。例如，攻击者可以利用该漏洞访问内部数据库、API或文件共享服务，窃取敏感数据或篡改系统配置。由于该漏洞无需身份验证，攻击者可以轻易地利用该漏洞进行攻击，造成广泛的影响。

Organizations that rely on Octo STS for OpenID Connect token validation, particularly those with internal services accessible via HTTP or HTTPS, are at risk. This includes applications that integrate with identity providers and use Octo STS to verify user authentication. Environments with limited network segmentation or inadequate WAF protection are especially vulnerable.

• go: Inspect application code for instances where Octo STS is used to validate OpenID Connect tokens. Look for code that directly uses the token's claims to construct outbound URLs without proper validation. • generic web: Monitor outbound network traffic from the application for requests to unexpected or internal IP addresses. Use tools like tcpdump or network intrusion detection systems (NIDS) to identify suspicious patterns. • linux / server: Examine application logs for errors related to token validation or unexpected outbound requests. Use journalctl to filter for relevant log entries.

journalctl -u your_app_service -f | grep "Octo STS" | grep "URL"

1. 2025-07-28Disclosure

   disclosure

1. 已保留2025-06-17
2. 发布日期2025-07-28
3. 修改日期2026-02-04
4. EPSS 更新日期2026-03-23

修复此漏洞的首要措施是立即升级到Octo STS 0.5.3或更高版本。如果无法立即升级，可以考虑实施一些临时缓解措施。例如，可以配置Web应用程序防火墙(WAF)或反向代理服务器，以阻止来自OpenID Connect令牌中的可疑请求。此外，还可以限制Octo STS应用程序的网络访问权限，只允许其访问必要的内部资源。在升级后，请务必验证修复是否有效，例如通过尝试发起一个SSRF请求，确认其被正确阻止。