CVE-2017-6413 (published 2017-03-02T06:59Z)

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 8.6, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/pingidentity/mod_auth_openidc
commit_details: repo_url: https://github.com/pingidentity/mod_auth_openidc
author: Hans Zandbelt
author_date: 2017-02-20 17:31:54+01:00
msg: release 2.1.6 : security fix: scrub headers for "AuthType oauth20"

Signed-off-by: Hans Zandbelt <hans.zandbelt@zmartzone.eu>
repository: repo_url: https://github.com/pingidentity/mod_auth_openidc
repo_name: OpenIDC/mod_auth_openidc
description: OpenID Certified™ OpenID Connect Relying Party implementation for Apache HTTP Server 2.x
repo_language: C
owner: pingidentity
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,7 @@
+02/20/2017
+- security fix: scrub headers for "AuthType oauth20"
+- release 2.1.6 
+
 02/15/2017
 - improve logging of session max duration and session inactivity timeout
 - refactor so that the call to the refresh hook also resets the session inactivity timeout and passes tokens down

programming_language: Markdown
filename: configure.ac
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,4 @@
-AC_INIT([mod_auth_openidc],[2.1.6rc2],[hans.zandbelt@zmartzone.eu])
+AC_INIT([mod_auth_openidc],[2.1.6],[hans.zandbelt@zmartzone.eu])
 
 AC_SUBST(NAMEVER, AC_PACKAGE_TARNAME()-AC_PACKAGE_VERSION())
 

programming_language: Shell
filename: mod_auth_openidc.c
change_type: ModificationType.MODIFY
diff: @@ -132,7 +132,7 @@ static void oidc_scrub_request_headers(request_rec *r, const char *claim_prefix,
 /*
  * scrub all mod_auth_openidc related headers
  */
-static void oidc_scrub_headers(request_rec *r) {
+void oidc_scrub_headers(request_rec *r) {
 	oidc_cfg *cfg = ap_get_module_config(r->server->module_config,
 			&auth_openidc_module);
 

programming_language: C
filename: mod_auth_openidc.h
change_type: ModificationType.MODIFY
diff: @@ -387,6 +387,7 @@ void oidc_request_state_set(request_rec *r, const char *key, const char *value);
 const char*oidc_request_state_get(request_rec *r, const char *key);
 int oidc_handle_jwks(request_rec *r, oidc_cfg *c);
 apr_byte_t oidc_post_preserve_javascript(request_rec *r, const char *location, char **javascript, char **javascript_method);
+void oidc_scrub_headers(request_rec *r);
 
 // oidc_oauth
 int oidc_oauth_check_userid(request_rec *r, oidc_cfg *c);

programming_language: C
filename: oauth.c
change_type: ModificationType.MODIFY
diff: @@ -664,6 +664,12 @@ int oidc_oauth_check_userid(request_rec *r, oidc_cfg *c) {
 				"Could not set remote user");
 	}
 
+	/*
+	 * we're going to pass the information that we have to the application,
+	 * but first we need to scrub the headers that we're going to use for security reasons
+	 */
+	oidc_scrub_headers(r);
+
 	/* set the user authentication HTTP header if set and required */
 	char *authn_header = oidc_cfg_dir_authn_header(r);
 	int pass_headers = oidc_cfg_dir_pass_info_in_headers(r);

programming_language: C