Summary
Dockhand before 1.0.50 does not adequately validate key OIDC claims, allowing an administrator from another tenant to obtain Dockhand administrator access. The issue becomes risky in shared identity-provider environments where tenant administrators can influence group mappings or identity claims accepted by Dockhand.
Dockhand before 1.0.50 does not adequately validate key OIDC claims, allowing an administrator from another tenant to obtain Dockhand administrator access. The issue becomes risky in shared identity-provider environments where tenant administrators can influence group mappings or identity claims accepted by Dockhand.
Affected context
The vulnerability occurs in Dockhand deployments that use OIDC authentication with a shared identity provider, such as Microsoft Entra ID. Risk is elevated when authorization depends on mapped groups and the application accepts identity tokens without validating the issuer, audience, nonce, and expiration claims against the intended tenant and authentication flow.
The vulnerability occurs in Dockhand deployments that use OIDC authentication with a shared identity provider, such as Microsoft Entra ID. Risk is elevated when authorization depends on mapped groups and the application accepts identity tokens without validating the issuer, audience, nonce, and expiration claims against the intended tenant and authentication flow.
Exploit preconditions
- Attack surface: Dockhand's OIDC login and group-to-role mapping process
- Required access: Administrative rights in another tenant served by the shared identity provider
- Trigger point: Authentication through the OIDC callback or token-processing flow
- Why exploitation is possible: Insufficient validation of issuer, audience, nonce, and expiration claims can allow a token or identity context from another tenant to be treated as valid for the target Dockhand tenant
- Attack surface: Dockhand's OIDC login and group-to-role mapping process
- Required access: Administrative rights in another tenant served by the shared identity provider
- Trigger point: Authentication through the OIDC callback or token-processing flow
- Why exploitation is possible: Insufficient validation of issuer, audience, nonce, and expiration claims can allow a token or identity context from another tenant to be treated as valid for the target Dockhand tenant
Why this happens
The underlying bug is an authorization boundary failure caused by incomplete validation of OIDC security claims. When an application does not confirm that the issuer and audience belong to the expected tenant and client, and does not enforce nonce and expiration checks, identities from an unintended security domain may pass authentication and receive privileges based on group mappings. This behavior maps to CWE-863: Incorrect Authorization, because access decisions are made without reliably binding the authenticated identity to the intended tenant and trust context.
The underlying bug is an authorization boundary failure caused by incomplete validation of OIDC security claims. When an application does not confirm that the issuer and audience belong to the expected tenant and client, and does not enforce nonce and expiration checks, identities from an unintended security domain may pass authentication and receive privileges based on group mappings. This behavior maps to CWE-863: Incorrect Authorization, because access decisions are made without reliably binding the authenticated identity to the intended tenant and trust context.
Potential impact
- An attacker may obtain Dockhand administrator privileges in another tenant.
- An attacker could access or modify tenant-managed resources.
- An attacker may change administrative settings, users, or integrations.
- An attacker could use administrative access to facilitate further compromise within the affected deployment.
- An attacker may obtain Dockhand administrator privileges in another tenant.
- An attacker could access or modify tenant-managed resources.
- An attacker may change administrative settings, users, or integrations.
- An attacker could use administrative access to facilitate further compromise within the affected deployment.
General mitigation guidance
Mitigation generally focuses on enforcing tenant-aware OIDC trust and making authorization decisions only after complete claim validation.
Common defensive patterns include:
- Require exact issuer and audience validation for the configured tenant and client.
- Enforce nonce and expiration checks as part of the authentication flow.
- Bind group mappings to the intended tenant and avoid trusting ambiguous group identifiers across tenants.
- Prefer single-tenant identity-provider configurations where cross-tenant trust is not required.
- Apply least privilege to mapped roles and separate authentication from authorization decisions.
- Review existing sessions, group mappings, and administrative assignments after strengthening validation.
Mitigation generally focuses on enforcing tenant-aware OIDC trust and making authorization decisions only after complete claim validation.
Common defensive patterns include:
- Require exact issuer and audience validation for the configured tenant and client.
- Enforce nonce and expiration checks as part of the authentication flow.
- Bind group mappings to the intended tenant and avoid trusting ambiguous group identifiers across tenants.
- Prefer single-tenant identity-provider configurations where cross-tenant trust is not required.
- Apply least privilege to mapped roles and separate authentication from authorization decisions.
- Review existing sessions, group mappings, and administrative assignments after strengthening validation.
How teams detect issues like this
Organizations can look for this class of issue through:
- Static and dynamic analysis of OIDC handlers for missing issuer, audience, nonce, or expiration checks.
- Code review signals such as authorization based solely on group names without tenant or issuer binding.
- Authentication tests using tokens from unintended tenants, issuers, audiences, and expired sessions.
- Identity-provider and application logs showing administrative logins whose issuer, tenant, or audience does not match the configured trust relationship.
- Policy enforcement requiring approved OIDC libraries, strict claim validation, and tenant-bound role mappings.
Automated security review tools may help identify incomplete claim validation, but runtime tests and configuration review are also important.
Organizations can look for this class of issue through:
- Static and dynamic analysis of OIDC handlers for missing issuer, audience, nonce, or expiration checks.
- Code review signals such as authorization based solely on group names without tenant or issuer binding.
- Authentication tests using tokens from unintended tenants, issuers, audiences, and expired sessions.
- Identity-provider and application logs showing administrative logins whose issuer, tenant, or audience does not match the configured trust relationship.
- Policy enforcement requiring approved OIDC libraries, strict claim validation, and tenant-bound role mappings.
Automated security review tools may help identify incomplete claim validation, but runtime tests and configuration review are also important.
