WSO2 API Manager JIT Provisioning improper authentication

Summaryinfo

A vulnerability identified as critical has been detected in WSO2 API Manager, Identity Server, Identity Server as Key Manager, Open Banking AM and Open Banking IAM. The affected element is an unknown function of the component JIT Provisioning Handler. Performing a manipulation results in improper authentication. This vulnerability is identified as CVE-2024-1248. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in WSO2 API Manager, Identity Server, Identity Server as Key Manager, Open Banking AM and Open Banking IAM. This affects some unknown functionality of the component JIT Provisioning Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user. Exploitation requires a federated identity provider (IDP) with silent JIT provisioning enabled and an attacker's knowledge of a local user's username. When these conditions are met, a malicious individual can leverage the JIT provisioning process to modify the roles of local users. The overwritten roles are limited to those defined within the federated IDP, typically granting minimal access rights unless explicitly configured otherwise by the federated IDP administrator.

It is possible to read the advisory at security.docs.wso2.com. This vulnerability is uniquely identified as CVE-2024-1248 since 02/06/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/05/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Banking Software

Vendor

• WSO2

Name

• API Manager
• Identity Server
• Identity Server as Key Manager
• Open Banking AM
• Open Banking IAM

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion