Key Confusion Flaws in Distributed Tasks
TitanWorkflow provides enterprise task orchestration across distributed cloud resources. Our team uncovered a flaw where its internal authorization check handles tokens using mismatched cryptographic algorithm definitions, allowing complete privilege escalation.
Attack Progression
By acquiring the target's public RSA validation key from an open discovery endpoint, an adversary can sign forged tokens locally using an HMAC-SHA256 signature layer. The target validation framework interprets the key string symmetrically, authenticating malicious payloads without error barriers.