CVE-2017-6062 in mod_auth_openidc
Summary
by MITRE
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2020
The vulnerability identified as CVE-2017-6062 affects the mod_auth_openidc module, a critical component for implementing OpenID Connect authentication within Apache HTTP Server environments. This module serves as the relying party implementation for OpenID Connect and functions as an OAuth 2.0 resource server, making it a fundamental security control for identity management in web applications. The flaw exists in versions prior to 2.1.5, representing a significant security gap that could compromise the integrity of authentication mechanisms. The vulnerability stems from improper handling of HTTP headers during the authentication process, specifically when the OIDCUnAuthAction directive is configured to pass requests rather than reject them. This misconfiguration creates a pathway for malicious actors to manipulate authentication flows through carefully crafted HTTP traffic patterns.
The technical implementation of this vulnerability resides in the header processing logic within the mod_auth_openidc module. When the OIDCUnAuthAction directive is set to "pass", the module should properly filter and exclude certain authentication-related headers from being passed through to the application layer. However, the flaw allows OIDC_CLAIM_ and OIDCAuthNHeader headers to be inadvertently included in the request processing pipeline, even when authentication has failed or is bypassed. This occurs because the module fails to properly sanitize the header environment during the authentication bypass scenario, creating a condition where attackers can inject or manipulate authentication headers that should normally be stripped or ignored. The vulnerability specifically affects the module's ability to distinguish between legitimate headers and potentially maliciously crafted ones during the unauthenticated action processing phase.
The operational impact of this vulnerability extends beyond simple authentication bypass to potentially enable privilege escalation and unauthorized access to protected resources. Attackers can exploit this weakness to craft HTTP requests that appear to contain valid authentication headers while actually bypassing the authentication mechanism entirely. This creates a scenario where malicious users can access restricted content or perform actions that should require proper authentication, effectively neutralizing the security controls implemented through OpenID Connect. The vulnerability is particularly concerning in environments where mod_auth_openidc is used for securing sensitive applications, as it could allow attackers to gain access to confidential data, administrative functions, or other protected resources without proper authorization. The attack vector requires minimal sophistication and can be executed through standard HTTP request manipulation techniques, making it a significant risk to organizations relying on this authentication module.
Organizations affected by this vulnerability should immediately upgrade to mod_auth_openidc version 2.1.5 or later, which contains the necessary patches to address the header sanitization issue. The fix implements proper header filtering mechanisms that ensure OIDC_CLAIM_ and OIDCAuthNHeader values are correctly excluded during OIDCUnAuthAction pass operations. Security administrators should also review their current configurations to ensure that OIDCUnAuthAction directives are properly implemented and that unnecessary header passing is minimized. Additional mitigations include implementing proper input validation at the application level, monitoring for unusual header patterns in access logs, and conducting regular security assessments of authentication mechanisms. This vulnerability aligns with CWE-20, "Improper Input Validation," and represents a specific instance of improper header handling that can be exploited through the ATT&CK technique of "T1078 - Valid Accounts" by allowing attackers to bypass authentication controls and gain unauthorized access to systems. Organizations should also consider implementing network-level controls such as web application firewalls to detect and prevent exploitation attempts targeting this specific vulnerability.