A path traversal vulnerability in the SciTokens library allows authenticated attackers to bypass directory restrictions and access unauthorized files.

This flaw is a path traversal vulnerability (CWE-22) residing in the Enforcer component. An authenticated attacker can manipulate the scope claim of a token using dot-dot sequences to escape intended directory restrictions, as the library fails to securely compare the authorized and requested paths.

The ability to traverse directories outside of intended constraints poses a significant risk to data confidentiality and integrity. If exploited, an attacker could potentially read sensitive files or configuration data, leading to unauthorized information disclosure. Given the CVSS score of 8.1, this is a high severity issue that requires immediate attention to protect system resources.

Immediate Action: Update the SciTokens library to version 1.9.7 or later to incorporate the necessary path normalization security fix.

Proactive Monitoring: Monitor application logs for suspicious access patterns involving directory traversal sequences or unexpected path requests within token claims.

Compensating Controls: Implement strict input validation on all token claims and ensure the hosting environment utilizes the principle of least privilege to restrict the filesystem access available to the application process.

Public Exploit Available: No

This vulnerability presents a high risk to environments relying on SciTokens for authorization management. Organizations should prioritize updating to version 1.9.7 immediately to remediate the flaw. Failure to patch may allow attackers to circumvent security boundaries and access restricted system files, necessitating prompt action by security and IT teams.