PT-2023-22011 · Apereo · Apereo Cas

Artsploit + 1 · Published 2023-06-27 · Updated 2024-08-05 · CVE-2023-28857

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apereo CAS versions prior to 6.6.6

Description The issue concerns Apereo CAS, an open source single sign-on solution. It can be configured to use authentication based on client X509 certificates, which can be provided via TLS handshake or a special HTTP header, such as "ssl client cert". When checking the validity of the provided client certificate, the system fetches URLs from the "CRL Distribution Points" extension of the certificate. If the CAS server is configured to use an LDAP server for x509 authentication with a password, it can lead to a password leak when making requests to LDAP URLs from the certificate, as it uses the same password as for the initially configured LDAP server. This allows an unauthenticated user to leak the password used for the LDAP connection configured on the server.

Recommendations For versions prior to 6.6.6, upgrade to version 6.6.6 to address the issue. As a temporary workaround, consider restricting access to the LDAP server or changing the password used for the LDAP connection to minimize the risk of exploitation. Avoid using the same password for multiple LDAP connections until the issue is resolved.

Exploit

Fix

Insufficiently Protected Credentials

Information Disclosure

Weakness Enumeration

CWE-522

CWE-200

Related Identifiers

CVE-2023-28857

GHSA-P78H-M8PV-G9GM

Affected Products

Apereo Cas

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28857.json · Exploit
• https://osv.dev/vulnerability/GHSA-p78h-m8pv-g9gm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28857 · Security Note
• https://github.com/apereo/cas · Note
• https://github.com/apereo/cas/releases/tag/v6.6.6 · Note
• https://github.com/graciantrivino/cas/blob/b90003f43a8ac0382d5416ceb01074feb936bf24/cas-server-support-x509/src/main/java/org/jasig/cas/adaptors/x509/authentication/handler/support/X509CredentialsAuthenticationHandler.java#L231 · Note
• https://securitylab.github.com/advisories/GHSL-2023-009_Apereo_CAS · Note
• https://securitylab.github.com/advisories · Note
• https://apereo.github.io/2023/02/20/x509-vuln · Note
• https://t.me/k8security/968 · Telegram Post