REDHAT-BUG-2331178: Code Injection

First published: Mon Dec 09 2024(Updated: )

When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, there is a potential for authorization code injection attacks. That means that an attacker can inject a stolen authorization code into the attacker's own session with the client. This allows the attacker to associate its session with the client with a victim's identity. Requirements to exploit: * The attacker needs to obtain an authorization code from an authorization response sent to the client. * The attacker can then access the application and start the login process with the legitimate client. * In the response of the OpenID provider to the legitimate client, the attacker can replace the newly sent authorization code with the previously stolen authorization code. * The legitimate client will send that stolen authorization code and along with its credentials to the OpenID provider to exchange the code for a token. * The OpenID provider's checks will succeed and a token will be issued to the client. * The attacker has now associated their session with the legitimate client with the victim's identity.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/severity
• agent/weakness
• agent/references
• agent/description
• agent/type
• agent/first-publish-date
• agent/event
• agent/source
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2024-12369
• agent/last-modified-date
• agent/tags
• agent/softwarecombine
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/red hat
• canonical/red hat single sign-on
• canonical/red hat elytron oidc client subsystem