PT-2024-5297 · Openiam · Openam

Aftersnows · Published 2024-07-24 · Updated 2024-08-06 · CVE-2024-41667

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenAM versions 15.0.3 and prior

Description The issue is related to the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java, which is vulnerable to template injection due to its usage of user input. This vulnerability allows an attacker to execute arbitrary code remotely. The developer intended to implement a custom URL for handling login, but did not restrict the CustomLoginUrlTemplate, allowing it to be set freely. A fix is expected to be part of version 15.0.4, which introduces TemplateClassResolver.SAFER RESOLVER to disable the resolution of commonly exploited classes in FreeMarker template injection.

Recommendations For OpenAM versions 15.0.3 and prior, update to version 15.0.4 or later, which is expected to include the fix for this issue. As a temporary workaround, consider restricting the CustomLoginUrlTemplate to prevent it from being set freely. Additionally, disabling the getCustomLoginUrlTemplate method until a patch is available can help minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-05922

CVE-2024-41667

GHSA-7726-43HG-M23V

Affected Products

Openam

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41667.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-41667 · Security Note
• https://osv.dev/vulnerability/GHSA-7726-43hg-m23v · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05922 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41667 · Vendor Advisory
• https://github.com/OpenIdentityPlatform/OpenAM · Note
• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-7726-43hg-m23v · Note
• https://github.com/OpenIdentityPlatform/OpenAM/commit/fcb8432aa77d5b2e147624fe954cb150c568e0b8 · Note
• https://t.me/cvenotify/89513 · Telegram Post
• https://t.me/cvenotify/87369 · Telegram Post
• https://t.me/cvedetector/1581 · Telegram Post
• https://securityonline.info/cve-2024-41667-openam-vulnerability-exposes-authentication-systems-to-critical-risk · Note
• https://t.me/pentestingnews/49804 · Telegram Post