CVE-2024-24814 (published 2024-02-13T19:15Z)

mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/OpenIDC/mod_auth_openidc
commit_details: repo_url: https://github.com/OpenIDC/mod_auth_openidc
author: Hans Zandbelt
author_date: 2024-02-06 23:45:40+01:00
msg: release 2.4.15.2: fix DoS CVE-2024-24814

fix CVE-2024-24814: DoS when `OIDCSessionType client-cookie` is set and
a crafted Cookie header is supplied
https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-hxr6-w4gc-7vvv

Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
repository: repo_url: https://github.com/OpenIDC/mod_auth_openidc
repo_name: OpenIDC/mod_auth_openidc
description: OpenID Certified™ OpenID Connect Relying Party implementation for Apache HTTP Server 2.x
repo_language: C
owner: OpenIDC
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,8 @@
+02/13/2024
+- CVE-2024-24814: prevent DoS when `OIDCSessionType client-cookie` is set and a crafted Cookie header is supplied
+  https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-hxr6-w4gc-7vvv
+- release 2.4.15.2
+
 01/31/2024
 - avoid crash when Forwarded is not present but OIDCXForwardedHeaders is configured for it; see #1171; thanks @daviddpd
 - bump to 2.4.15.2dev

programming_language: Markdown
filename: configure.ac
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-AC_INIT([mod_auth_openidc],[2.4.15.2dev],[hans.zandbelt@openidc.com])
+AC_INIT([mod_auth_openidc],[2.4.15.2],[hans.zandbelt@openidc.com])
 
 AC_SUBST(NAMEVER, AC_PACKAGE_TARNAME()-AC_PACKAGE_VERSION())
 

programming_language: Shell
filename: util.c
change_type: ModificationType.MODIFY
diff: @@ -1559,23 +1559,24 @@ static char *oidc_util_get_chunk_cookie_name(request_rec *r, const char *cookieN
  * get a cookie value that is split over a number of chunked cookies
  */
 char *oidc_util_get_chunked_cookie(request_rec *r, const char *cookieName, int chunkSize) {
-	char *cookieValue = NULL;
-	char *chunkValue = NULL;
-	int i = 0;
-	if (chunkSize == 0) {
-		cookieValue = oidc_util_get_cookie(r, cookieName);
-	} else {
-		int chunkCount = oidc_util_get_chunked_count(r, cookieName);
-		if (chunkCount > 0) {
-			cookieValue = "";
-			for (i = 0; i < chunkCount; i++) {
-				chunkValue = oidc_util_get_cookie(r, oidc_util_get_chunk_cookie_name(r, cookieName, i));
-				if (chunkValue != NULL)
-					cookieValue = apr_psprintf(r->pool, "%s%s", cookieValue, chunkValue);
-			}
-		} else {
-			cookieValue = oidc_util_get_cookie(r, cookieName);
+	char *cookieValue = NULL, *chunkValue = NULL;
+	int chunkCount = 0, i = 0;
+	if (chunkSize == 0)
+		return oidc_util_get_cookie(r, cookieName);
+	chunkCount = oidc_util_get_chunked_count(r, cookieName);
+	if (chunkCount == 0)
+		return oidc_util_get_cookie(r, cookieName);
+	if ((chunkCount < 0) || (chunkCount > 99)) {
+		oidc_warn(r, "chunk count out of bounds: %d", chunkCount);
+		return NULL;
+	}
+	for (i = 0; i < chunkCount; i++) {
+		chunkValue = oidc_util_get_cookie(r, oidc_util_get_chunk_cookie_name(r, cookieName, i));
+		if (chunkValue == NULL) {
+			oidc_warn(r, "could not find chunk %d; aborting", i);
+			break;
 		}
+		cookieValue = apr_psprintf(r->pool, "%s%s", cookieValue ? cookieValue : "", chunkValue);
 	}
 	return cookieValue;
 }

programming_language: C