Description

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in which HTTP request parameters affect an authorizationRequest.

Remediation

References

http://agrrrdog.blogspot.com/2017/03/autobinding-vulns-and-spring-mvc.html

https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/commit/7eba3c12fed82388f917e8dd9b73e86e3a311e4c

https://portswigger.net/research/hidden-oauth-attack-vectors

Related Vulnerabilities

CVE-2023-31544 Vulnerability in maven package org.opencms:opencms-core

CVE-2022-36093 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates

CVE-2021-23379 Vulnerability in npm package portkiller

CVE-2020-27543 Vulnerability in npm package restify-paginate

CVE-2020-7646 Vulnerability in npm package curlrequest

Severity

Critical

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Tags

Exploit Third Party Advisory Patch