CVE-2024-24814: Insufficient Information (NVD-CWE-noinfo)
value: mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-13T19:15Z
Repository: https://github.com/OpenIDC/mod_auth_openidc
Language: Other
Files changed: ChangeLog, configure.ac, src/util.c
Commit date: 2024-02-06 23:45:40 +0100
Commit message: release 2.4.15.2: fix DoS CVE-2024-24814

fix CVE-2024-24814: DoS when `OIDCSessionType client-cookie` is set and
a crafted Cookie header is supplied
https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-hxr6-w4gc-7vvv

Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
Diff: diff --git a/ChangeLog b/ChangeLog
index 761e145c..1136582b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,10 @@
+02/13/2024
+- CVE-2024-24814: prevent DoS when `OIDCSessionType client-cookie` is set and a crafted Cookie header is supplied
+  https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-hxr6-w4gc-7vvv
+- release 2.4.15.2
+
 01/31/2024
 - avoid crash when Forwarded is not present but OIDCXForwardedHeaders is configured for it; see #1171; thanks @daviddpd
 - bump to 2.4.15.2dev
 
 01/30/2024
diff --git a/configure.ac b/configure.ac
index 5f334ddd..0ffa5140 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,6 +1,6 @@
-AC_INIT([mod_auth_openidc],[2.4.15.2dev],[hans.zandbelt@openidc.com])
+AC_INIT([mod_auth_openidc],[2.4.15.2],[hans.zandbelt@openidc.com])
 
 AC_SUBST(NAMEVER, AC_PACKAGE_TARNAME()-AC_PACKAGE_VERSION())
 
 AM_INIT_AUTOMAKE([-Wall -Werror foreign subdir-objects])
 
diff --git a/src/util.c b/src/util.c
index 1248d977..7feda79c 100644
--- a/src/util.c
+++ b/src/util.c
@@ -1557,27 +1557,28 @@ static char *oidc_util_get_chunk_cookie_name(request_rec *r, const char *cookieN
 
 /*
  * get a cookie value that is split over a number of chunked cookies
  */
 char *oidc_util_get_chunked_cookie(request_rec *r, const char *cookieName, int chunkSize) {
-	char *cookieValue = NULL;
-	char *chunkValue = NULL;
-	int i = 0;
-	if (chunkSize == 0) {
-		cookieValue = oidc_util_get_cookie(r, cookieName);
-	} else {
-		int chunkCount = oidc_util_get_chunked_count(r, cookieName);
-		if (chunkCount > 0) {
-			cookieValue = "";
-			for (i = 0; i < chunkCount; i++) {
-				chunkValue = oidc_util_get_cookie(r, oidc_util_get_chunk_cookie_name(r, cookieName, i));
-				if (chunkValue != NULL)
-					cookieValue = apr_psprintf(r->pool, "%s%s", cookieValue, chunkValue);
-			}
-		} else {
-			cookieValue = oidc_util_get_cookie(r, cookieName);
+	char *cookieValue = NULL, *chunkValue = NULL;
+	int chunkCount = 0, i = 0;
+	if (chunkSize == 0)
+		return oidc_util_get_cookie(r, cookieName);
+	chunkCount = oidc_util_get_chunked_count(r, cookieName);
+	if (chunkCount == 0)
+		return oidc_util_get_cookie(r, cookieName);
+	if ((chunkCount < 0) || (chunkCount > 99)) {
+		oidc_warn(r, "chunk count out of bounds: %d", chunkCount);
+		return NULL;
+	}
+	for (i = 0; i < chunkCount; i++) {
+		chunkValue = oidc_util_get_cookie(r, oidc_util_get_chunk_cookie_name(r, cookieName, i));
+		if (chunkValue == NULL) {
+			oidc_warn(r, "could not find chunk %d; aborting", i);
+			break;
 		}
+		cookieValue = apr_psprintf(r->pool, "%s%s", cookieValue ? cookieValue : "", chunkValue);
 	}
 	return cookieValue;
 }
 
 /*

Vulnerable code: AC_INIT([mod_auth_openidc],[2.4.15.2dev],[hans.zandbelt@openidc.com])
	char *cookieValue = NULL;
	char *chunkValue = NULL;
	int i = 0;
	if (chunkSize == 0) {
		cookieValue = oidc_util_get_cookie(r, cookieName);
	} else {
		int chunkCount = oidc_util_get_chunked_count(r, cookieName);
		if (chunkCount > 0) {
			cookieValue = "";
			for (i = 0; i < chunkCount; i++) {
				chunkValue = oidc_util_get_cookie(r, oidc_util_get_chunk_cookie_name(r, cookieName, i));
				if (chunkValue != NULL)
					cookieValue = apr_psprintf(r->pool, "%s%s", cookieValue, chunkValue);
			}
		} else {
			cookieValue = oidc_util_get_cookie(r, cookieName);
Fixed code: 02/13/2024
- CVE-2024-24814: prevent DoS when `OIDCSessionType client-cookie` is set and a crafted Cookie header is supplied
  https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-hxr6-w4gc-7vvv
- release 2.4.15.2

AC_INIT([mod_auth_openidc],[2.4.15.2],[hans.zandbelt@openidc.com])
	char *cookieValue = NULL, *chunkValue = NULL;
	int chunkCount = 0, i = 0;
	if (chunkSize == 0)
		return oidc_util_get_cookie(r, cookieName);
	chunkCount = oidc_util_get_chunked_count(r, cookieName);
	if (chunkCount == 0)
		return oidc_util_get_cookie(r, cookieName);
	if ((chunkCount < 0) || (chunkCount > 99)) {
		oidc_warn(r, "chunk count out of bounds: %d", chunkCount);
		return NULL;
	}
	for (i = 0; i < chunkCount; i++) {
		chunkValue = oidc_util_get_cookie(r, oidc_util_get_chunk_cookie_name(r, cookieName, i));
		if (chunkValue == NULL) {
			oidc_warn(r, "could not find chunk %d; aborting", i);
			break;
		cookieValue = apr_psprintf(r->pool, "%s%s", cookieValue ? cookieValue : "", chunkValue);