A path traversal vulnerability in the SciTokens C++ library allows authenticated users to escalate authorization privileges by manipulating path-based scopes.

This vulnerability occurs because the library normalizes path-based scopes by collapsing parent-directory components instead of rejecting them. This flaw allows an authenticated user to perform a directory traversal attack, effectively broadening their access permissions beyond the intended scope.

The ability to bypass intended authorization scopes poses a significant risk to data integrity and confidentiality. By traversing outside of permitted directories, an attacker could gain unauthorized access to sensitive files or data, leading to potential data exfiltration or unauthorized system modifications. Given the high CVSS score of 8.3, this vulnerability represents a substantial security risk that requires prompt mitigation to prevent unauthorized access to restricted resources.

Immediate Action: Update the scitokens-cpp library to version 1.4.1 or later immediately to incorporate the necessary path validation fixes.

Proactive Monitoring: Review application logs for suspicious scope requests or attempts to access file paths containing parent-directory indicators such as double dots.

Compensating Controls: Ensure that the underlying filesystem permissions for the application service account are as restrictive as possible to limit the scope of potential traversal attempts.

Public Exploit Available: Unknown

The risk posed by this authorization bypass is elevated due to the existence of a proof-of-concept and the potential for privilege escalation. Security teams should prioritize the deployment of the 1.4.1 patch to ensure that scope normalization is handled securely and that path traversal attempts are rejected. Failure to remediate this vulnerability may allow attackers to circumvent access controls and compromise protected data assets.