CVE-2024-1440: WSO2 Authentication Endpoint Vulnerable to Open Redirect
Summary
CVE-2024-1440: WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint. Affects org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.endpoint.util across 2 version ranges.
< 5.25.707
>= 6.0.0, < 7.0.111
Fixed in 5.25.707 or 7.0.111, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package, org.wso2.carbon.identity.application.authentication.endpoint.util, is part of the WSO2 Identity Framework, which provides authentication and identity management solutions for applications. This package facilitates multi-option authentication, allowing users to authenticate through various methods. However, it has been found to be vulnerable to an open redirection issue, which can be exploited by malicious actors.
Vulnerability Detail
An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. This flaw allows attackers to craft valid links that redirect users to malicious sites. By exploiting this vulnerability, attackers can trick users into visiting harmful pages, potentially leading to phishing attacks that harvest sensitive information or facilitate other malicious actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.25.7075.25.707 -
>= 6.0.0, < 7.0.1117.0.111
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that multi-option authentication is disabled until the package can be updated to the patched version. This can be done by modifying the configuration settings in your WSO2 Identity Framework setup.
Conclusion
The open redirection vulnerability in the WSO2 Identity Framework's authentication endpoint poses a significant risk to applications utilizing this package. It is crucial to update to the latest patched version to safeguard against potential exploitation. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.endpoint.util →
FAQ
CVE-2024-1440 is a vulnerability in the WSO2 Identity Framework that allows for open redirection attacks through its authentication endpoint.
If exploited, this vulnerability can redirect users to malicious sites, leading to potential phishing attacks and data theft.
You should update to the patched version of the package as soon as possible to mitigate the risk.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your pom.xml. You can also check your application using the Vulert playground without any signup.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
