CVE-2024-22209: Edx-platform Auth Bypass Vulnerability

CVE-2024-22209 Overview

CVE-2024-22209 affects the Open edX Platform, a service-oriented platform for authoring and delivering online learning. The vulnerability allows an authenticated user holding a JSON Web Token (JWT) with limited scopes to invoke endpoints that exceed the granted access. This constitutes a broken access control issue tracked under [CWE-284]. The flaw resides in the Learning Management System (LMS) courseware rendering path, specifically in lms/djangoapps/courseware/block_render.py. The maintainers patched the issue in commit 019888f3d15beaebcb7782934f6c43b0c2b3735e by enforcing the JwtRestrictedApplication permission class on affected endpoints.

Critical Impact
Authenticated users with restricted JWT scopes can access LMS courseware endpoints outside their authorization boundary, leading to loss of confidentiality, integrity, and availability of course content and related data.

Affected Products

Open edX Platform (edx-platform) versions prior to the fix commit 019888f
Deployments using JWT authentication via edx_rest_framework_extensions
Self-hosted and managed Open edX LMS instances exposing courseware APIs

Discovery Timeline

2024-01-13 - CVE-2024-22209 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22209

Vulnerability Analysis

The vulnerability is a broken access control flaw in the Open edX LMS courseware rendering module. Endpoints authenticated with JWTs did not verify whether the presenting token carried the required scopes for the requested operation. As a result, a caller possessing a JWT issued for a restricted OAuth2 application could reach endpoints intended for higher-privileged callers. The issuing infrastructure produces JWTs with granular scopes for third-party integrations, but the courseware code path bypassed the scope check. Exploitation requires only a valid but low-scoped JWT, making the attack reachable by any registered integration or user who can obtain a token.

Root Cause

The root cause is the absence of the JwtRestrictedApplication permission class on courseware endpoints in block_render.py. Without this permission, the Django REST Framework view accepted any authenticated JWT regardless of its declared scopes. Authentication was validated, but authorization at the scope level was not enforced, violating the principle of least privilege.

Attack Vector

The attack occurs over the network against the Open edX LMS API. An attacker obtains a JWT with limited scopes, either as a legitimate restricted integration or by compromising such credentials. The attacker then calls affected courseware endpoints, and the server processes the request as if the caller had unrestricted access. No user interaction is required beyond the API request itself.

python

 from edx_proctoring.api import get_attempt_status_summary
 from edx_proctoring.services import ProctoringService
 from edx_rest_framework_extensions.auth.jwt.authentication import JwtAuthentication
+from edx_rest_framework_extensions.permissions import JwtRestrictedApplication
 from edx_when.field_data import DateLookupFieldData
 from eventtracking import tracker
 from opaque_keys import InvalidKeyError

Source: GitHub Commit 019888f. The patch imports JwtRestrictedApplication and applies it to the affected view so that JWT scope restrictions are honored before the endpoint executes.

Detection Methods for CVE-2024-22209

Indicators of Compromise

Access log entries showing successful HTTP 200 responses on courseware endpoints from OAuth2 clients registered as restricted applications.
JWTs presenting narrow scopes such as read or integration-specific values while accessing endpoints that historically required broader scopes.
Unusual volume of API calls from a single restricted OAuth2 client identifier against /courseware/ or block rendering routes.

Detection Strategies

Audit LMS access logs for JWT-authenticated requests to block_render endpoints and correlate the presenting client's registered scopes against the accessed route.
Compare Open edX deployment commit hash against 019888f3d15beaebcb7782934f6c43b0c2b3735e to confirm patch status.
Review OAuth2 application inventory in django-oauth-toolkit for restricted clients and enumerate their recent API usage.

Monitoring Recommendations

Emit and centrally collect authentication logs with JWT client_id, scopes claim, and target endpoint for every LMS API request.
Alert on any restricted JWT application accessing courseware routes outside its documented scope set.
Track anomalies in per-client API call distribution to surface scope escalation attempts against Open edX APIs.

How to Mitigate CVE-2024-22209

Immediate Actions Required

Upgrade Open edX Platform to a release that includes commit 019888f3d15beaebcb7782934f6c43b0c2b3735e or later.
Rotate JWT signing keys and revoke tokens issued to restricted OAuth2 applications that may have been abused.
Review and tighten the scopes granted to every registered OAuth2 client, removing unused integrations.

Patch Information

The fix is available in the upstream repository via commit 019888f. See the GitHub Security Advisory GHSA-qx8m-mqx3-j9fm and the GitHub Commit Change. Operators should rebuild container images or update deployments to pull the patched code and restart LMS workers.

Workarounds

Restrict network access to the LMS API to trusted integrations until the patch is deployed.
Temporarily disable or suspend restricted OAuth2 applications that do not require immediate availability.
Apply reverse-proxy rules that require additional authentication headers for sensitive courseware endpoints.

bash

# Verify the deployed edx-platform commit contains the fix
cd /edx/app/edxapp/edx-platform
git log --oneline | grep 019888f || echo "Patch NOT applied - upgrade required"

# List OAuth2 restricted applications for review
python manage.py lms shell -c \
  "from oauth2_provider.models import Application; \
   [print(a.client_id, a.name) for a in Application.objects.all()]"