A high-severity unauthenticated Server-Side Request Forgery vulnerability in Eclipse CSI - PIA allows remote attackers to perform unauthorized OIDC discovery requests.

This vulnerability (CWE-918) exists in the /v1/upload/sbom endpoint. An unauthenticated attacker can supply a malicious JWT, which the application processes using unverified issuer claims, leading to an SSRF condition during OIDC discovery.

This vulnerability is particularly severe because it is unauthenticated, allowing any remote attacker to trigger the SSRF. A successful exploit can lead to unauthorized data disclosure or potential manipulation of the OIDC discovery process, potentially impacting the integrity of the software supply chain management systems. The CVSS 4.0 score of 8.8 reflects this elevated risk to system integrity.

Immediate Action: Update to Eclipse CSI - PIA version 0.6.0 or the latest available release to ensure proper validation of JWT claims.

Proactive Monitoring: Monitor server logs for unexpected requests to external OIDC providers or anomalous patterns originating from the upload endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block requests containing suspicious or malformed JWT structures.

Public Exploit Available: false

Due to the unauthenticated nature of this vulnerability, immediate patching is essential to prevent unauthorized access. Security teams should treat this as a high-priority update to maintain the integrity of the application environment.