CVE-2021-44878 Information

Description

If an OpenID Connect provider supports the one\ algorithm (i.e. tokens with no signature) pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the \idtoken\ response type which is not secure and violates the OpenID Core Specification. The one\ algorithm does not require any signature verification when validating the ID tokens which allows the attacker to bypass the token validation by injecting a malformed ID token using one\ as the value of lg\ key in the header with an empty signature value.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Reference

https://github.com/pac4j/pac4j/commit/22b82ffd702a132d9f09da60362fc6264fc281ae https://openid.net/specs/openid-connect-core-1_0.html#IDToken https://www.pac4j.org/blog/cve_2021_44878_is_this_serious.html

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

NONE

Base Severity

7.5