Casdoor Cross-Organization Token Exchange Vulnerability Allowing Privilege Escalation

A vulnerability in Casdoor versions through 2.362.0 allows cross-organization token exchange, leading to privilege escalation. The issue arises in the GetTokenExchangeToken function, which validates JWT signatures but fails to ensure that the token's user is from the same organization as the target application. This oversight can result in unauthorized access across different organizations.

Impact

Exploitation of this vulnerability can lead to unauthorized privilege escalation across organizational boundaries in Casdoor deployments.

Remediation

Users are advised to implement stricter identity governance controls, restrict the use of identity providers to trusted sources, and monitor logs for unusual SAML or token activity. High-privilege accounts should be reinforced with additional authentication measures, such as multi-factor authentication.