Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting a UAA access token or a cross-client ID token as the callback\u2019s id_token parameter.<\/p>\n
The issue only manifests when a UAA zone is configured with an OIDC identity provider whose issuer exactly matches that zone\u2019s own \/oauth\/token endpoint (a \u201cself-UAA\u201d OIDC configuration). In this configuration, the callback takes a supplied id_token directly instead of requiring the authorization code exchange, and does not verify that the token was actually issued as an ID token for the specific self-OIDC relying-party client. An attacker holding any valid UAA JWT for themselves \u2014 including a plain access token with only uaa.user scope, or a valid ID token issued to an unrelated client such as cf \u2014 can present it as the callback\u2019s id_token and be authenticated into a mapped local (\u201cshadow\u201d) account. Because the resulting session is not verified against the originating token\u2019s true audience or user_id, its effective privilege depends entirely on the shadow account\u2019s group memberships, which can include administrative scopes such as clients.write.<\/p>\n
Exploitation requires a valid UAA user JWT, a valid browser login state for the target zone, and the presence of a self-referential OIDC provider configuration \u2014 this is not a pre-authentication vulnerability, and does not by itself grant privileges beyond those already held by the mapped shadow account.<\/p>\n","protected":false},"excerpt":{"rendered":"
Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth aut<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33095","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33095","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}