CVE-2017-6413: Improper Authentication (CWE-287)
value: The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.6
Published: 2017-03-02T06:59Z
Repository: https://github.com/pingidentity/mod_auth_openidc
Language: C
Files changed: ChangeLog, configure.ac, src/mod_auth_openidc.c, src/mod_auth_openidc.h, src/oauth.c
Commit date: 2017-02-20 17:31:54 +0100
Commit message: release 2.1.6 : security fix: scrub headers for "AuthType oauth20"

Signed-off-by: Hans Zandbelt <hans.zandbelt@zmartzone.eu>
Diff: diff --git a/ChangeLog b/ChangeLog
index f296b8a..6ffe5bf 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
+02/20/2017
+- security fix: scrub headers for "AuthType oauth20"
+- release 2.1.6 
+
 02/15/2017
 - improve logging of session max duration and session inactivity timeout
 - refactor so that the call to the refresh hook also resets the session inactivity timeout and passes tokens down
 
 02/14/2017
diff --git a/configure.ac b/configure.ac
index 4cc1e27..6946c85 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,6 +1,6 @@
-AC_INIT([mod_auth_openidc],[2.1.6rc2],[hans.zandbelt@zmartzone.eu])
+AC_INIT([mod_auth_openidc],[2.1.6],[hans.zandbelt@zmartzone.eu])
 
 AC_SUBST(NAMEVER, AC_PACKAGE_TARNAME()-AC_PACKAGE_VERSION())
 
 # This section defines the --with-apxs2 option.
 AC_ARG_WITH(
diff --git a/src/mod_auth_openidc.c b/src/mod_auth_openidc.c
index 36cbc66..f24000d 100644
--- a/src/mod_auth_openidc.c
+++ b/src/mod_auth_openidc.c
@@ -130,11 +130,11 @@ static void oidc_scrub_request_headers(request_rec *r, const char *claim_prefix,
 }
 
 /*
  * scrub all mod_auth_openidc related headers
  */
-static void oidc_scrub_headers(request_rec *r) {
+void oidc_scrub_headers(request_rec *r) {
 	oidc_cfg *cfg = ap_get_module_config(r->server->module_config,
 			&auth_openidc_module);
 
 	if (cfg->scrub_request_headers != 0) {
 
diff --git a/src/mod_auth_openidc.h b/src/mod_auth_openidc.h
index 79d331c..5777ead 100644
--- a/src/mod_auth_openidc.h
+++ b/src/mod_auth_openidc.h
@@ -385,10 +385,11 @@ int oidc_auth_checker(request_rec *r);
 #endif
 void oidc_request_state_set(request_rec *r, const char *key, const char *value);
 const char*oidc_request_state_get(request_rec *r, const char *key);
 int oidc_handle_jwks(request_rec *r, oidc_cfg *c);
 apr_byte_t oidc_post_preserve_javascript(request_rec *r, const char *location, char **javascript, char **javascript_method);
+void oidc_scrub_headers(request_rec *r);
 
 // oidc_oauth
 int oidc_oauth_check_userid(request_rec *r, oidc_cfg *c);
 
 // oidc_proto.c
diff --git a/src/oauth.c b/src/oauth.c
index 4659ab4..48cfd41 100644
--- a/src/oauth.c
+++ b/src/oauth.c
@@ -662,10 +662,16 @@ int oidc_oauth_check_userid(request_rec *r, oidc_cfg *c) {
 				"remote user could not be set, aborting with HTTP_UNAUTHORIZED");
 		return oidc_oauth_return_www_authenticate(r, "invalid_token",
 				"Could not set remote user");
 	}
 
+	/*
+	 * we're going to pass the information that we have to the application,
+	 * but first we need to scrub the headers that we're going to use for security reasons
+	 */
+	oidc_scrub_headers(r);
+
 	/* set the user authentication HTTP header if set and required */
 	char *authn_header = oidc_cfg_dir_authn_header(r);
 	int pass_headers = oidc_cfg_dir_pass_info_in_headers(r);
 	int pass_envvars = oidc_cfg_dir_pass_info_in_envvars(r);
 

Vulnerable code: AC_INIT([mod_auth_openidc],[2.1.6rc2],[hans.zandbelt@zmartzone.eu])
static void oidc_scrub_headers(request_rec *r) {
Fixed code: 02/20/2017
- security fix: scrub headers for "AuthType oauth20"
- release 2.1.6 

AC_INIT([mod_auth_openidc],[2.1.6],[hans.zandbelt@zmartzone.eu])
void oidc_scrub_headers(request_rec *r) {
void oidc_scrub_headers(request_rec *r);
	/*
	 * we're going to pass the information that we have to the application,
	 * but first we need to scrub the headers that we're going to use for security reasons
	 */
	oidc_scrub_headers(r);