PT-2021-17109 · Mitre · Mitreid Connect

Artsploit · Published 2021-03-25 · Updated 2021-05-13 · CVE-2021-26715

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MITREid Connect versions 1.3.3 and earlier

Description The OpenID Connect server implementation contains a Server Side Request Forgery (SSRF) vulnerability due to unsafe usage of the logo uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make an HTTP request from the vulnerable server to any address in the internal network and obtain its response, potentially leading to bypassing network boundaries, obtaining sensitive data, or attacking other hosts in the internal network.

Recommendations For versions 1.3.3 and earlier, as a temporary workaround, consider restricting the usage of the logo uri parameter in the Dynamic Client Registration request to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-26715

GHSA-792R-MH2Q-P8QP

Affected Products

Mitreid Connect

References · 8

• 🔥 https://portswigger.net/research/hidden-oauth-attack-vectors · Exploit
• https://osv.dev/vulnerability/CVE-2021-26715 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26715 · Security Note
• https://osv.dev/vulnerability/GHSA-792r-mh2q-p8qp · Vendor Advisory
• https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/releases · Note
• https://t.me/ptswarm/15 · Telegram Post
• https://t.me/cvenotify/11937 · Telegram Post
• https://t.me/cvenotify/12254 · Telegram Post