CVE-2024-24825: Diracgrid Dirac Information Disclosure

CVE-2024-24825 Overview

CVE-2024-24825 is an information disclosure vulnerability in DIRAC, a distributed resource framework used in high-energy physics and grid computing environments. The flaw allowed any authenticated user to retrieve an OAuth token that had been requested by another user or agent. This cross-user token exposure could grant unintended access to protected resources managed through DIRAC's TokenManager service. The maintainers addressed the issue in release 8.0.37.

Critical Impact
Authenticated users could obtain tokens belonging to other users or agents, enabling unauthorized access to grid resources and federated identity provider services.

Affected Products

DIRAC (diracgrid/DIRAC) versions prior to 8.0.37
DIRAC Framework TokenManager service
Deployments using TokenDB for OAuth token caching

Discovery Timeline

2024-02-09 - CVE-2024-24825 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24825

Vulnerability Analysis

The vulnerability resides in the DIRAC TokenManagerHandler service, which brokers OAuth access and refresh tokens for users and agents interacting with Identity Providers (IdPs). DIRAC implemented a server-side token cache to reduce round trips to both the TokenManager service and the upstream IdP. The cache lookup logic did not adequately bind cached tokens to the requesting principal. As a result, a user issuing a token request could receive a cached token previously obtained by a different user or agent. This information disclosure issue is classified under [CWE-200].

Root Cause

The root cause is improper isolation in the shared server-side token cache within TokenManagerHandler.py. Tokens issued by the Identity Provider were stored and returned without sufficient verification that the requesting identity matched the original requester. The patch removes the server-side cache entirely and routes token issuance through the TokenDB refresh-token exchange path, eliminating the shared-state condition.

Attack Vector

Exploitation requires network access to the DIRAC TornadoManager service and valid credentials to issue a token request. An authenticated user invokes the standard getToken RPC, and the service may return a cached token belonging to another user or agent. No user interaction or elevated privileges are required.

python

# Patch excerpt: src/DIRAC/FrameworkSystem/Service/TokenManagerHandler.py
# Before: service-side cache could return another user's token
# After: client-only cache; server always exchanges via TokenDB refresh token

# - The service and its client have a mechanism for caching the received tokens.
# + The client has a mechanism for caching the received tokens.
#
# Otherwise, the client makes an RPC call to the TornadoManager service.
# - It in turn checks the cache and if the access token is already invalid
# -   tries to update it using a refresh token.
# - If the required token is not in the cache, then the refresh token from TokenDB
# -   is taken and the exchange token request to Identity Provider is made.
# -   The received tokens are cached.
# + The refresh token from TokenDB is taken and the
# +   exchange token request to Identity Provider is made.

Source: DIRACGrid/DIRAC commit f9ddab7

Detection Methods for CVE-2024-24825

Indicators of Compromise

TokenManager service logs showing getToken calls returning tokens whose sub or owner claim does not match the requesting DIRAC user or agent identity
Identity Provider audit logs reflecting resource access from a DIRAC principal that did not initiate the original token exchange
Unexpected reuse of the same access token across distinct DIRAC client sessions

Detection Strategies

Audit TokenManagerHandler request and response pairs to correlate the caller identity against the token subject returned
Review grid job submission and pilot logs for token-authenticated actions that do not align with the submitting user
Compare deployed DIRAC version against the fixed release 8.0.37 using package inventory queries

Monitoring Recommendations

Enable verbose logging on the TornadoManager and TokenManager services and forward logs to a centralized analytics platform for correlation
Monitor the TokenDB for anomalous access patterns and unusual refresh-token usage rates
Alert on any DIRAC server still running versions prior to 8.0.37 discovered via configuration management or asset inventory

How to Mitigate CVE-2024-24825

Immediate Actions Required

Upgrade all DIRAC installations to version 8.0.37 or later as the primary remediation
Rotate any OAuth client secrets and refresh tokens stored in TokenDB that may have been exposed prior to patching
Review Identity Provider audit logs for the exposure window and revoke any tokens suspected of cross-user retrieval

Patch Information

The fix is delivered in DIRAC release 8.0.37 via commit f9ddab755b9a69acb85e14d2db851d8ac0c9648c. The patch removes the server-side token cache in TokenManagerHandler.py so the service always sources tokens through the TokenDB refresh-token exchange. Refer to the GitHub Security Advisory GHSA-59qj-jcjv-662j for advisory details.

Workarounds

No workarounds are available per the vendor advisory; upgrading to 8.0.37 is required
Restrict network access to the TornadoManager service to trusted hosts as a temporary risk-reduction measure until patching is complete

bash

# Upgrade DIRAC to the patched release
pip install --upgrade "DIRAC>=8.0.37"

# Verify the installed version
python -c "import DIRAC; print(DIRAC.version)"