OpenIDC mod_auth_openidc up to 2.4.15.1 mod_auth_openidc_session_chunks resource consumption

Summaryinfo

A vulnerability described as problematic has been identified in OpenIDC mod_auth_openidc up to 2.4.15.1. This issue affects the function mod_auth_openidc_session_chunks. Such manipulation leads to resource consumption. This vulnerability is traded as CVE-2024-24814. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in OpenIDC mod_auth_openidc up to 2.4.15.1. It has been rated as problematic. Affected by this issue is the function mod_auth_openidc_session_chunks. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was shared 02/13/2024. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-24814 since 01/31/2024. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 210515 (RHEL 8 : mod_auth_openidc:2.3 (RHSA-2024:5289)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.4.15.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (210515) and CERT Bund (WID-SEC-2024-1850). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux

Productinfo

Vendor

• OpenIDC

Name

• mod_auth_openidc

Version

• 2.4.15.0
• 2.4.15.1

License

• open-source

Website

• Product: https://github.com/OpenIDC/mod_auth_openidc/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion