PT-2022-12251 · Pac4J · Pac4J

Jérôme Leleu · Published 2022-01-06 · Updated 2022-05-13 · CVE-2021-44878

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions pac4j versions 5.3.0 and prior pac4j versions 5.1 and earlier

Description The issue concerns the support of the "none" algorithm by an OpenID Connect provider, which allows tokens with no signature. This algorithm does not require signature verification when validating ID tokens, enabling an attacker to bypass token validation by injecting a malformed ID token using "none" as the value of the alg key in the header with an empty signature value. This behavior violates the OpenID Core Specification and is not secure.

Recommendations For pac4j versions 5.3.0 and prior, ensure explicit configuration to refuse the "none" algorithm. For pac4j versions 5.1 and earlier, update the configuration to reject ID tokens with the "none" algorithm to prevent token validation bypass. As a temporary workaround, consider disabling the use of the "none" algorithm for ID token validation until a proper fix is applied.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2021-44878

GHSA-XHW6-HJC9-679M

Affected Products

Pac4J

References · 11

• https://github.com/pac4j/pac4j/commit/22b82ffd702a132d9f09da60362fc6264fc281ae · Patch
• https://osv.dev/vulnerability/GHSA-xhw6-hjc9-679m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44878 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44878 · Vendor Advisory
• https://pac4j.org/blog/cve_2021_44878_is_this_serious.html · Vendor Advisory
• https://github.com/pac4j/pac4j · Note
• https://github.com/pac4j/pac4j/commit/9c87bbc536ed5d05f940ae015403120df2935589 · Note
• https://github.com/pac4j/pac4j/commit/09684e0de1c4753d22c53b8135d4ef61cfda76f7 · Note
• https://pac4j.org/4.5.x/docs/release-notes.html · Note
• https://openid.net/specs/openid-connect-core-1_0.html#IDToken · Note
• https://t.me/cibsecurity/35044 · Telegram Post