REDHAT-BUG-2452269: High severity OpenBao OpenBao vulnerability
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the authorization code flow, the direct mode calls back directly to the API and allows an attacker to poll for an OpenBao token until it is issued. Version 2.5.2 includes an additional confirmation screen for direct type logins that requires manual user interaction in order to finish the authentication. This issue can be worked around either by removing any roles with callbackmode=direct or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.5.2 - Configuration
Remove/disable any OpenBao roles where callback_mode is set to `direct` to prevent direct callback polling and remote phishing.
OpenBao role.callback_mode = remove any roles with callback_mode=direct - Configuration
On the token issuer side, enforce confirmation for every session for the Client ID used by OpenBao (JWT/OIDC) to prevent unattended login via the victim's browser.
OpenBao (token issuer / client for JWT/OIDC) enforce confirmation for every session = enabled