Apache CXF 3.3.5 OpenId Connect JWK Keys Service Key insufficiently protected credentials

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Apache CXF 3.3.5. Affected by this issue is some unknown functionality of the component OpenId Connect JWK Keys Service. Performing a manipulation results in insufficiently protected credentials (Key). This vulnerability was named CVE-2019-12423. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability was found in Apache CXF 3.3.5 (Application Server Software). It has been classified as problematic. This affects an unknown functionality of the component OpenId Connect JWK Keys Service. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability (Key). CWE is classifying the issue as CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. This is going to have an impact on confidentiality. The summary by CVE is:

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". For this case all keys are returned in this file "as is", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. "oct" keys, which contain secret keys, are not returned at all.

The weakness was presented 01/16/2020 (Website). The advisory is shared at lists.apache.org. This vulnerability is uniquely identified as CVE-2019-12423 since 05/28/2019. An attack has to be approached locally. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/17/2020). MITRE ATT&CK project uses the attack technique T1552 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-158137, VDB-158138, VDB-158139 and VDB-158244 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• CXF

Version

• 3.3.5

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion