github - ghsa-5565-3c98-g6jc

ghsa-5565-3c98-g6jc

Vulnerability from github

Published

2025-03-25 21:49

Modified

2025-03-25 21:49

Severity ?

4.2 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Summary

WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack

Details

Impact

A vulnerability was found in OIDC-Client. When using the elytron-oidc-client subsystem with WildFly, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.

Patches

2.2.9.Final 2.6.2.Final

Workarounds

Currently, no mitigation is currently available for this vulnerability.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-12369 https://access.redhat.com/security/cve/CVE-2024-12369
https://bugzilla.redhat.com/show_bug.cgi?id=2331178 https://issues.redhat.com/browse/ELY-2887

Show details on source website

JSON

To clipboard

{
   affected: [
      {
         package: {
            ecosystem: "Maven",
            name: "org.wildfly.security:wildfly-elytron",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "1.17.0.Final",
                  },
                  {
                     fixed: "2.2.9.Final",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
      {
         package: {
            ecosystem: "Maven",
            name: "org.wildfly.security:wildfly-elytron",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "2.3.0.Final",
                  },
                  {
                     fixed: "2.6.2.Final",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
      {
         package: {
            ecosystem: "Maven",
            name: "org.wildfly.security:wildfly-elytron-http-oidc",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "1.17.0.Final",
                  },
                  {
                     fixed: "2.2.9.Final",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
      {
         package: {
            ecosystem: "Maven",
            name: "org.wildfly.security:wildfly-elytron-http-oidc",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "2.3.0.Final",
                  },
                  {
                     fixed: "2.6.2.Final",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2024-12369",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-345",
      ],
      github_reviewed: true,
      github_reviewed_at: "2025-03-25T21:49:11Z",
      nvd_published_at: null,
      severity: "MODERATE",
   },
   details: "### Impact\n\nA vulnerability was found in OIDC-Client. When using the elytron-oidc-client subsystem with WildFly, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.\n\n### Patches\n\n[2.2.9.Final](https://github.com/wildfly-security/wildfly-elytron/releases/tag/2.2.9.Final)\n[2.6.2.Final](https://github.com/wildfly-security/wildfly-elytron/releases/tag/2.6.2.Final)\n\n### Workarounds\n\nCurrently, no mitigation is currently available for this vulnerability.\n\n### References\n\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-12369\nhttps://access.redhat.com/security/cve/CVE-2024-12369\t\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2331178\nhttps://issues.redhat.com/browse/ELY-2887",
   id: "GHSA-5565-3c98-g6jc",
   modified: "2025-03-25T21:49:11Z",
   published: "2025-03-25T21:49:11Z",
   references: [
      {
         type: "WEB",
         url: "https://github.com/wildfly-security/wildfly-elytron/security/advisories/GHSA-5565-3c98-g6jc",
      },
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2024-12369",
      },
      {
         type: "WEB",
         url: "https://github.com/wildfly-security/wildfly-elytron/pull/2253",
      },
      {
         type: "WEB",
         url: "https://github.com/wildfly-security/wildfly-elytron/pull/2261",
      },
      {
         type: "WEB",
         url: "https://github.com/wildfly-security/wildfly-elytron/commit/5ac5e6bbcba58883b3cebb2ddbcec4de140c5ceb",
      },
      {
         type: "WEB",
         url: "https://github.com/wildfly-security/wildfly-elytron/commit/d7754f5a6a91ceb0f4dbbbfe301991f6a55404cb",
      },
      {
         type: "WEB",
         url: "https://access.redhat.com/security/cve/CVE-2024-12369",
      },
      {
         type: "WEB",
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2331178",
      },
      {
         type: "PACKAGE",
         url: "https://github.com/wildfly-security/wildfly-elytron",
      },
      {
         type: "WEB",
         url: "https://issues.redhat.com/browse/ELY-2887",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
         type: "CVSS_V3",
      },
   ],
   summary: "WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack",
}

cve-2024-12369

Vulnerability from cvelistv5

Published

2024-12-09 20:53

Modified

2025-03-19 16:21

Severity ?

4.2 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Summary

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.

References

▼	URL	Tags
	https://access.redhat.com/security/cve/CVE-2024-12369	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2331178	issue-tracking, x_refsource_REDHAT

Impacted products

Vendor

Product

Version

▼

Version: 0 ≤ 34.0.1.Final

Red Hat	Red Hat Build of Keycloak	cpe:/a:redhat:build_keycloak:
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform 8	cpe:/a:redhat:jboss_enterprise_application_platform:8

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-12369",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-12-10T15:29:39.382723Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-12-10T15:29:50.674Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://github.com/wildfly/wildfly",
               defaultStatus: "unknown",
               packageName: "wildfly",
               versions: [
                  {
                     lessThanOrEqual: "34.0.1.Final",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:",
               ],
               defaultStatus: "unaffected",
               packageName: "org.jboss.eap/wildfly-elytron-oidc-client-subsystem",
               product: "Red Hat Build of Keycloak",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7",
               ],
               defaultStatus: "affected",
               packageName: "org.wildfly/wildfly-elytron-oidc-client-subsystem",
               product: "Red Hat JBoss Enterprise Application Platform 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8",
               ],
               defaultStatus: "affected",
               packageName: "org.wildfly/wildfly-elytron-oidc-client-subsystem",
               product: "Red Hat JBoss Enterprise Application Platform 8",
               vendor: "Red Hat",
            },
         ],
         credits: [
            {
               lang: "en",
               value: "This issue was discovered by Olivier Rivat (Red Hat).",
            },
         ],
         datePublic: "2024-12-09T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Moderate",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.2,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-345",
                     description: "Insufficient Verification of Data Authenticity",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-19T16:21:47.553Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2024-12369",
            },
            {
               name: "RHBZ#2331178",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2331178",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2024-12-09T16:26:06.388000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2024-12-09T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Elytron-oidc-client: oidc authorization code injection",
         workarounds: [
            {
               lang: "en",
               value: "Currently, no mitigation is currently available for this vulnerability.",
            },
         ],
         x_redhatCweChain: "CWE-345: Insufficient Verification of Data Authenticity",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2024-12369",
      datePublished: "2024-12-09T20:53:09.260Z",
      dateReserved: "2024-12-09T16:33:36.277Z",
      dateUpdated: "2025-03-19T16:21:47.553Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-5565-3c98-g6jc

Vulnerability from github

Impact

Patches

Workarounds

References

cve-2024-12369

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature