REDHAT-BUG-2452294: XSS
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The errordescription parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with callbackmode set to direct.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.5.2 - Configuration
Mitigate by removing any OpenBao roles configured with `callback_mode=direct` when OIDC/JWT authentication is enabled.
OpenBao role.callback_mode = remove roles where callback_mode=direct