CVE-2024-41667

HIGHNuclei

OpenAM FreeMarker template injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-41667 has a selected CVSS score of 8.8 (high); EIP currently links 1 Nuclei template.

Description

OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to override the default OpenAM login, they did not restrict the `CustomLoginUrlTemplate`, allowing it to be set freely. Commit fcb8432aa77d5b2e147624fe954cb150c568e0b8 introduces `TemplateClassResolver.SAFER_RESOLVER` to disable the resolution of commonly exploited classes in FreeMarker template injection. As of time of publication, this fix is expected to be part of version 15.0.4.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 26, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

OpenAM

Browse OpenIdentityPlatform / OpenAM

Default status: unknown

CVE List< 15.0.4affected
Before 15.0.4affected

org.openidentityplatform.openam:openam-oauth2

Browse Maven / org.openidentityplatform.openam:openam-oauth2
GitHub AdvisoryBefore 15.0.4 · Fixed in 15.0.4affected

Nuclei templates

1
ProjectDiscoveryHIGHOpenAM<=15.0.3 FreeMarker - Template InjectionCVSS 8.8

OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input

Impact

Authenticated attackers can exploit template injection to execute arbitrary code on the OpenAM server.

Remediation

Update OpenAM to a version later than 15.0.3 that patches the template injection vulnerability.

WeaknessesCWE-94
Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2024intrusiveopenamsstiauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
https://github.com/advisories/GHSA-7726-43hg-m23v https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-7726-43hg-m23v https://github.com/OpenIdentityPlatform/OpenAM/commit/fcb8432aa77d5b2e147624fe954cb150c568e0b8 https://nvd.nist.gov/vuln/detail/CVE-2024-41667

Source: ProjectDiscovery

References

4