CVE-2024-41948
Biscuitsec Biscuit-Java 3.0.0 – 4.0.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:NSummary
CVE-2024-41948 is a low-severity Improper Restriction of Security Token Assignment (CWE-1259) vulnerability in Biscuitsec Biscuit-Java. Its CVSS base score is 3.0 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Access Token Manipulation (T1134); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2267
Vulnerability Data
biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the necessary…
more
info to generate a third-party block and to sign it, which includes the public key of the previous block (used in the signature) and the public keys part of the token symbol table (for public key interning in datalog expressions). A third-part block request forged by a malicious user can trick the third-party authority into generating datalog trusting the wrong keypair. This vulnerability is fixed in 4.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
A tamperproof reference monitor ensures security tokens cannot be improperly assigned or altered outside policy.
Access enforcement directly requires that security tokens used for authorization decisions are protected from unauthorized assignment or modification.
Isolating security functions from non-security functions reduces the attack surface for tampering with token assignment logic.
Security attributes (tokens) must be associated and maintained with subjects/objects, which structurally prevents improper assignment or lack of protection.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper definition and enforcement of authorizations directly addresses improper security token restrictions.
Pre-acquisition hardware integrity checks can detect flawed token protection mechanisms before deployment.
Logical access protections can prevent exploitation of improperly assigned hardware security tokens.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Privileged access rights help ensure only authorized processes can assign or modify tokens.
Security testing can detect improper token assignment but does not prevent it at design time.
Information access restriction directly limits which entities can obtain or use security tokens.
Secure architecture principles can guide token protection mechanisms but do not enforce assignment rules.
Secure coding practices reduce the likelihood of token-assignment bugs but do not define the policy.
Cryptography can protect token confidentiality but does not address improper assignment logic.