Authentication Bypass Vulnerability in libapache2-mod-auth-openidc
Summary
CVE-2017-6062: The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" c... Affects libapache2-mod-auth-openidc across 2 version ranges.
< 2.1.5-1
< e81822a7d5f5bdf04ba03ca92680821893303850
Fixed in 2.1.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libapache2-mod-auth-openidc module is an OpenID Connect Relying Party and OAuth 2.0 Resource Server for the Apache HTTP Server. It enables web applications to authenticate users via OpenID Connect, providing a secure method for user authentication and authorization. However, prior to version 2.1.5, this module is susceptible to a critical vulnerability that allows attackers to bypass authentication mechanisms.
Vulnerability Detail
The vulnerability, identified as CVE-2017-6062, arises from the failure of the libapache2-mod-auth-openidc module to properly handle OIDC_CLAIM_ and OIDCAuthNHeader headers in configurations that utilize 'OIDCUnAuthAction pass'. This oversight permits remote attackers to exploit crafted HTTP traffic to bypass authentication, potentially leading to unauthorized access to sensitive resources. The vulnerability has a CVSS score of 8.6, indicating a high severity level.
How To Fix
Minimum fixed version
2.1.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libapache2-mod-auth-openidcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the configuration to avoid using 'OIDCUnAuthAction pass' until the module is updated. This may involve changing the authentication flow or implementing additional access controls to mitigate the risk of unauthorized access.
Conclusion
The CVE-2017-6062 vulnerability in the libapache2-mod-auth-openidc module poses a significant risk by allowing authentication bypass through crafted HTTP requests. It is crucial for users of this module to upgrade to version 2.1.5-1 or later to ensure the security of their applications. Temporary workarounds can be implemented until an upgrade is feasible.
See every vulnerability recorded for libapache2-mod-auth-openidc →
FAQ
CVE-2017-6062 is a vulnerability in the libapache2-mod-auth-openidc module that allows remote attackers to bypass authentication through crafted HTTP requests.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Exploitation of this vulnerability could lead to unauthorized access to applications that rely on the libapache2-mod-auth-openidc module for user authentication, potentially compromising sensitive data.
Yes, the vulnerability has been addressed in version 2.1.5-1 of the libapache2-mod-auth-openidc module. Upgrading to this version or later will mitigate the risk.
If immediate upgrading is not possible, consider implementing a workaround by avoiding the use of 'OIDCUnAuthAction pass' in your configuration to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for libapache2-mod-auth-openidc.
