REDHAT-BUG-2452294: XSS
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The errordescription parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with callbackmode set to direct.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.5.2 - Configuration
Mitigate by removing any OpenBao roles configured with `callback_mode=direct` when OIDC/JWT authentication is enabled.
OpenBao role.callback_mode = remove roles where callback_mode=direct
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2452294?
The severity of REDHAT-BUG-2452294 is classified as high with a score of 7.
What type of vulnerability is REDHAT-BUG-2452294?
REDHAT-BUG-2452294 is classified as a Cross-Site Scripting (XSS) vulnerability.
How do I fix REDHAT-BUG-2452294?
To fix REDHAT-BUG-2452294, upgrade OpenBao to version 2.5.2 or later.
What systems are affected by REDHAT-BUG-2452294?
OpenBao installations with the OIDC/JWT authentication method and `callback_mode=direct` are affected by REDHAT-BUG-2452294.
What is the impact of exploiting REDHAT-BUG-2452294?
Exploiting REDHAT-BUG-2452294 can allow attackers to perform Cross-Site Scripting (XSS), potentially compromising user sessions.