octo-sts/app · Security
Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens
- GHSA ID
- GHSA-h3qp-hwvr-9xcq
- CVE ID
- CVE-2025-52477
- Severity
- high
- Published
- Updated
- CVSS
- 8.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- CVSS v3
- 8.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Description
Summary
Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information.
Please upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging.
Many thanks to @vicevirus for reporting this issue and for assisting with remediation review.
References
CWEs
- CWE-918 · Server-Side Request Forgery (SSRF)
References
- https://github.com/octo-sts/app/security/advisories/GHSA-h3qp-hwvr-9xcq ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-52477 ↗
- https://github.com/octo-sts/app/commit/0f177fde54f9318e33f0bba6abaea9463a7c3afd ↗
- https://github.com/octo-sts/app/commit/b3976e39bd8c8c217c0670747d34a4499043da92 ↗
- https://github.com/advisories/GHSA-h3qp-hwvr-9xcq ↗