Описание
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback_mode=direct configured are vulnerable to XSS via the error_description parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The error_description parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with callback_mode set to direct.
A flaw was found in OpenBao. Installations that have an OIDC/JWT authentication method enabled with a role configured to use callback_mode=direct are vulnerable to XSS via the error_description parameter on the page for a failed authentication. This allows an attacker to access the token used by an authenticated user in the Web UI.
Отчет
To exploit this vulnerability, an attacker needs to convince a user to visit a crafted URL, limiting the exposure of this flaw. Due to this reason, this issue has been rated with an important severity.
Меры по смягчению последствий
To mitigate this vulnerability, review JWT/OIDC authentication configurations and remove or disable any roles that have 'callback_mode=direct'.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | cryostat/cryostat-storage-rhel9 | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
9.6 Critical
CVSS3
Связанные уязвимости
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with `callback_mode=direct` configured are vulnerable to XSS via the `error_description` parameter on the page for a failed authentication. This allows an attacker access to the token used in the Web UI by a victim. The `error_description` parameter has been replaced with a static error message in v2.5.2. The vulnerability can be mitigated by removing any roles with `callback_mode` set to `direct`.
OpenBao is an open source identity-based secrets management system. Pr ...
OpenBao has Reflected XSS in its OIDC authentication error message
Уязвимость метода аутентификации JWT/OIDC системы управления секретами и шифрованием OpenBao, позволяющая нарушителю проводить XSS-атаки
EPSS
9.6 Critical
CVSS3