CVE-2021-27582: Autobinding vulnerability in MITREid Connect
Summary
CVE-2021-27582: Autobinding vulnerability in MITREid Connect. Affects org.mitre:openid-connect-parent versions < 1.3.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MITREid Connect is an OpenID Connect server implementation that provides authentication and authorization services. It is widely used in various applications and systems. The vulnerable package, org.mitre:openid-connect-parent, is a Maven package that includes the server implementation. This package is susceptible to an Autobinding vulnerability, which occurs during the OAuth authorization flow. The vulnerability arises from unsafe usage of the @ModelAttribute annotation, allowing HTTP request parameters to affect an authorizationRequest.
Vulnerability Detail
The Autobinding vulnerability in MITREid Connect allows an attacker to manipulate HTTP request parameters during the OAuth authorization flow. By exploiting this vulnerability, an attacker can modify the authorizationRequest, potentially leading to unauthorized access or privilege escalation. The vulnerability has a CVSS score of 9.1, indicating a critical severity level. It is important to address this vulnerability promptly to prevent potential security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the affected functionality that utilizes the OAuth authorization flow. This can be achieved by modifying the configuration of your application or system to bypass or remove the vulnerable code segment. However, this workaround may impact the functionality and user experience of the application. It is strongly recommended to apply the official fix as soon as possible.
Conclusion
The Autobinding vulnerability in MITREid Connect poses a critical security risk, allowing attackers to manipulate authorization requests during the OAuth flow. To mitigate this vulnerability, it is crucial to update the org.mitre:openid-connect-parent package to version 1.3.4 or later. Additionally, ensure that all components relying on MITREid Connect are updated and thoroughly tested. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.mitre:openid-connect-parent →
FAQ
MITREid Connect is an OpenID Connect server implementation that provides authentication and authorization services. It is widely used in various applications and systems.
An Autobinding vulnerability, also known as Mass Assignment vulnerability, occurs when user-controlled input is directly assigned to an object's properties without proper validation or sanitization. This can lead to unauthorized access, privilege escalation, or other security risks.
This vulnerability allows an attacker to manipulate HTTP request parameters during the OAuth authorization flow, potentially leading to unauthorized access or privilege escalation. It is a critical vulnerability with a CVSS score of 9.1.
To fix this vulnerability, update the org.mitre:openid-connect-parent package to version 1.3.4 or later. Make sure to update all components relying on MITREid Connect and thoroughly test for any compatibility issues.
As a temporary workaround, you can disable the functionality that utilizes the OAuth authorization flow. However, it is strongly recommended to apply the official fix as soon as possible.
