Boruta Server
Monthly
BEAM atom table exhaustion in Boruta Server prior to 0.10.0 allows any authenticated end user to crash the entire OAuth 2.0/OpenID Connect umbrella application by repeatedly submitting PUT /users/settings requests with arbitrary novel body keys. The UserSettingsController calls String.to_atom/1 on all user-supplied map keys before any validation, permanently interning them in the Erlang VM's global atom table (hard cap: 1,048,576 entries). Once exhausted, the BEAM runtime aborts with 'no more index entries in atom_tab', taking down the auth, admin, and gateway components simultaneously. No public exploit identified at time of analysis, and the issue has been patched in version 0.10.0.
Sensitive token logging in Boruta Server before 0.10.0 allows any party with read access to business event logs - including log aggregation systems and the built-in administration log viewer - to recover live OAuth 2.0 and OpenID Connect credentials. Exposed values include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, and VP tokens logged during normal authorization and token issuance flows. An attacker who recovers these credentials can impersonate users or clients on any resource server that trusts the stolen tokens until expiration or explicit revocation. No public exploit or active exploitation has been identified.
BEAM atom table exhaustion in Boruta Server prior to 0.10.0 allows any authenticated end user to crash the entire OAuth 2.0/OpenID Connect umbrella application by repeatedly submitting PUT /users/settings requests with arbitrary novel body keys. The UserSettingsController calls String.to_atom/1 on all user-supplied map keys before any validation, permanently interning them in the Erlang VM's global atom table (hard cap: 1,048,576 entries). Once exhausted, the BEAM runtime aborts with 'no more index entries in atom_tab', taking down the auth, admin, and gateway components simultaneously. No public exploit identified at time of analysis, and the issue has been patched in version 0.10.0.
Sensitive token logging in Boruta Server before 0.10.0 allows any party with read access to business event logs - including log aggregation systems and the built-in administration log viewer - to recover live OAuth 2.0 and OpenID Connect credentials. Exposed values include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, and VP tokens logged during normal authorization and token issuance flows. An attacker who recovers these credentials can impersonate users or clients on any resource server that trusts the stolen tokens until expiration or explicit revocation. No public exploit or active exploitation has been identified.