Date: Tue, 23 Feb 2016 13:43:55 +0000
From: Alexandre Herzog <Alexandre.Herzog@...c.ch>
To: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
 "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] CSNC-2016-002 - Open Redirect in OpenAM

#############################################################

#

# COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html

#############################################################

#

# CSNC ID:          CSNC-2016-002

# Product:          OpenAM [1]

# Vendor:           ForgeRock

# Subject:           Open Redirect

# Risk:                  Critical

# Effect:              Remotely exploitable

# Author:            Stephan Sekula (stephan.sekula@...c.de)

# Date:                 February 23rd 2016

#

#############################################################





Introduction:

-------------

OpenAM provides core identity services to simplify the implementation of

transparent single sign-on (SSO) as a security component in a network

infrastructure. OpenAM provides the foundation for integrating diverse

web applications that might typically operate against a disparate set of

identity repositories and are hosted on a variety of platforms such as

web and application servers. [1]



Compass Security discovered a web application security flaw in the OpenAM

application which allows an attacker to launch phishing attacks against users

by redirecting them to a malicious website. An attacker is able to create a

link that, when visited, will redirect the user to a website of the attacker's

choosing once the victim attempts to login. This allows, for instance,

phishing of user credentials. Since it is the victim who needs to visit the

malicious link, this attack is possible for unauthenticated attackers who do

not have access to the affected websites.





Affected Versions:

------------------

The following OpenAM versions are vulnerable:

- 9.5.5

- 10.0.2

- 10.1.0-Xpress

- 11.0.0-11.0.3

- 12.0.0-12.0.2



OpenAM version 13.0.0 is not vulnerable.





Patches:

--------

OpenAM released patches for each affected version as part of OpenAM

Security Advisory #201601 [2].





Technical Description:

----------------------

OpenAM provides a whitelist mechanism that allows specifying allowed

redirection URLs. If user input is not part of this whitelist, the user should

be redirected to an error page. However, this mechanism only works for

parameter values of the form "http://www.csnc.de" and "www.csnc.de". Parameter

values such as "//www.csnc.de" will not be caught, thus effectively bypassing

the whitelist mechanism.



Example:

/openam_sp/UI/Login?goto=//www.csnc.de&gotoOnFail=//www.csnc.de



Exploiting the vulnerability will lead to redirections to arbitrary websites

which allows phishing of user credentials.





Milestones:

-----------

2015-12-16: Vulnerability discovered

2016-01-04: Vendor notified

2016-02-05: Vendor provided patched version

2016-02-23: Public disclosure





References:

-----------

[1] http://openam.forgerock.org/

[2] https://forgerock.org/2016/02/openam-security-advisory-201601/


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists