Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 3.9.2
- Public exploit
- None on Exploit-DB
Summary
The Eclipse ioFog Operator, which manages ioFog Controller deployments, is affected. An attacker positioned on the network path can impersonate the Controller or identity provider and steal login credentials, such as the OAuth client secret or the Controller admin password, along with the access token the operator uses for later Controller API calls.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret (external mode) or the Controller bootstrap admin password (embedded mode with Controller HTTPS enabled), and supply the access token the operator stores for later Controller API calls. v3.8 removed Keycloak. The exposed credential is not a Keycloak realm-admin secret.
Affected versions
- Eclipse Foundation Eclipse ioFog
From 3.8.0 · fixed in 3.9.2