Eclipse EDC: Consumer pull transfer token validation checks not applied
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse EDC Connector | 0.5.0 to before 0.9.0 | 0.9.0 | Patch available | CNA |
| — | org.eclipse.edc:transfer-data-plane (Maven) | 0.5.0 to before 0.9.0 | 0.9.0 | Patch available | GHSA-8259-2x72-2gvc |
- Eclipse EDC Connector VendorEclipse Foundation Affected 0.5.0 to before 0.9.0 Fixed in 0.9.0 Patch available CNA
- org.eclipse.edc:transfer-data-plane (Maven) Vendor— Affected 0.5.0 to before 0.9.0 Fixed in 0.9.0 Patch available GHSA-8259-2x72-2gvc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:eclipse_dataspace_components:*:*:*:*:*:*:*:* | 0.5.0 to before 0.9.0 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:eclipse_dataspace_components:*:*:*:*:*:*:*:* Versions 0.5.0 to before 0.9.0 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Eclipse EDC Connector (Eclipse Foundation) Fixed in 0.9.0
- Fix · GHSA-8259-2x72-2gvc org.eclipse.edc:transfer-data-plane (Maven) Fixed in 0.9.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-8642
- 2026-10-03 Alias added: GHSA-8259-2x72-2gvc
References
Advisory 2
Other 5
- https://gitlab.eclipse.org/security/cve-assignement/-/issues/28
- https://github.com/eclipse-edc/Connector/releases/tag/v0.9.0
- https://github.com/eclipse-edc/Connector
- https://github.com/eclipse-edc/Connector/blob/bcb2e42aee82ce1863be3dcbdab29919d39a0e97/extensions/control-plane/transfer/transfer-data-plane/src/main/java/org/eclipse/edc/connector/controlplane/transfer/dataplane/api/ConsumerPullTransferTokenValidationApiController.java
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/28
More Eclipse Foundation Eclipse Dataspace Components vulnerabilities
- TI-2024-08538 EDC DataSetResolver policy filtering missing CVSS 4.0MEDIUM 5.3
Sources
- CVE-2024-8642 · CVE Program
- CVE-2024-8642 · NVD
- FIRST EPSS
- GHSA-8259-2x72-2gvc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences