Openam Openam Consortium Edition
Monthly
Open redirect in OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier allows remote unauthenticated attackers to send a victim's browser to an arbitrary site after single sign-on. The goto parameter of the /preLogin endpoint is persisted unvalidated as the Liberty ID-FF RelayState and replayed by the assertion consumer service as a redirect target; because a victim must be induced to open the crafted URL and then actually authenticate at the identity provider, exploitation requires user interaction. Only deployments with a Liberty ID-FF hosted service provider explicitly configured are exposed, since that legacy federation profile is not enabled by default, and the resulting impact is limited to phishing-grade redirection (C:N/I:L/A:N) rather than compromise of OpenAM itself. 14.0.6 resolves the issue by disabling the legacy Liberty ID-FF endpoints; no public exploit code is available, with technical details and proof-of-concept code deliberately withheld by the reporter.
Open redirect in OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier allows remote unauthenticated attackers to send a victim's browser to an arbitrary site after single sign-on. The goto parameter of the /preLogin endpoint is persisted unvalidated as the Liberty ID-FF RelayState and replayed by the assertion consumer service as a redirect target; because a victim must be induced to open the crafted URL and then actually authenticate at the identity provider, exploitation requires user interaction. Only deployments with a Liberty ID-FF hosted service provider explicitly configured are exposed, since that legacy federation profile is not enabled by default, and the resulting impact is limited to phishing-grade redirection (C:N/I:L/A:N) rather than compromise of OpenAM itself. 14.0.6 resolves the issue by disabling the legacy Liberty ID-FF endpoints; no public exploit code is available, with technical details and proof-of-concept code deliberately withheld by the reporter.