CVE-2024-35133
MEDIUMIBM Security Verify Access 10.0.0-10.0.8 - Authenticated Open Redirect via OIDC Provider
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-35133. PoCs published by Giulio Garzia, Ozozuz.
AI-analyzed exploit summary This is a detailed technical writeup describing an open redirect vulnerability in IBM Security Verify Access during the OAuth flow. The vulnerability allows bypassing the redirect_uri validation by embedding credentials in the URI, leading to potential leakage of OAuth tokens.
Description
IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Exploits (3)
This is a detailed technical writeup describing an open redirect vulnerability in IBM Security Verify Access during the OAuth flow. The vulnerability allows bypassing the redirect_uri validation by embedding credentials in the URI, leading to potential leakage of OAuth tokens.
This repository provides a detailed technical analysis of CVE-2024-35133, an open redirect vulnerability in IBM Security Verify Access during the OAuth flow. It includes a proof of concept demonstrating how an attacker can manipulate the 'redirect_uri' parameter to bypass domain whitelist filters and steal OAuth tokens.
This repository provides a detailed technical analysis of CVE-2024-35133, an open redirect vulnerability in IBM Security Verify Access during the OAuth flow. It includes a proof of concept demonstrating how an attacker can bypass the redirect_uri validation to leak OAuth tokens.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N