Description

A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T06:17:23.820Z",
  "pubdate": "2026-09-07T06:17:23.820Z",
  "executiveSummary": "A critical security vulnerability has been identified in the projeto-siga siga authentication mechanism, specifically within the ExAutenticacaoController.autenticar function.\nThis vulnerability is categorized as a missing authorization flaw, which allows unauthorized actors to bypass security controls by manipulating the 'cod' or 'jwt' arguments during the authentication process.\nThe flaw affects versions up to 11.0.2.10, 11.0.2.13, and 11.1.1 of the application.\nThe vulnerability is remotely exploitable, requiring no prior authentication, and enables an attacker to gain unauthorized access to the system. The public disclosure of the exploit increases the risk of active exploitation by malicious entities.\nGiven that the project maintainers have not yet responded to initial reports, the system remains in a high-risk state with no official patch currently available to mitigate the logic flaw.",
  "technicalDetails": "The vulnerability resides within the Authentication Flow component, specifically in the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java.\nThe root cause is an improper implementation of authorization checks within the 'autenticar' function. When the application processes incoming requests, it fails to sufficiently validate the integrity and legitimacy of the 'cod' (code) or 'jwt' (JSON Web Token) parameters provided by the client.\nThe exploitation method involves an attacker crafting a malicious request targeting the authentication endpoint. By injecting or manipulating these parameters, an attacker can trick the 'autenticar' function into successfully completing the authentication flow without validating the user's identity or credentials against the backend identity store.\nThe attack flow proceeds as follows: First, the attacker identifies the authentication endpoint managed by the ExAutenticacaoController. Second, the attacker interacts with the 'cod' or 'jwt' parameter, potentially providing an empty, malformed, or specifically crafted value that causes the logic within the function to short-circuit or erroneously default to an authorized state.\nBecause the controller does not verify the signature of the JWT or validate the session state associated with the 'cod' parameter, the system erroneously concludes that the request is legitimate. The application subsequently establishes an authenticated session for the attacker, granting access to restricted resources associated with the manipulated user context.\nThis vulnerability is network-exposed, as the authentication controller is reachable via standard HTTP/HTTPS protocols without prior authentication requirements. The impact is significant, as it leads to a complete bypass of the application's authentication layer, potentially allowing for unauthorized data access, administrative action performance, and full session hijacking of the target application.\nThe lack of server-side validation of these tokens effectively renders the entire authentication mechanism unreliable for versions up to 11.0.2.10, 11.0.2.13, and 11.1.1. Post-exploitation, an attacker can maintain persistence within the application and escalate privileges if the underlying system roles are misconfigured or loosely defined, given that they have already bypassed the primary entry-point security check."
}