Tsujiguchitky

Built-in identities in the Top Level Realm, specifically `demo`, `anonymous`, `wsc`, `wsp`, `SecurityTokenService`, and `agentAuth`, are shipped with identical, publicly known passwords across all installations. This allows unauthenticated remote attackers to log in as these identities to obtain authenticated sessions. Furthermore, the agent identities can be used to read the configuration of other agent profiles.

Insufficient validation of responses on the internal server-to-server SOAP channel allows network-positioned attackers to compromise integrity and availability. Attackers who control a site server or intercept unencrypted traffic can crash receiving processes, tamper with writable files, and potentially execute arbitrary code.

A cross-site request forgery issue exists in the OAuth 2.0 device authorization flow. This occurs when consent is skipped for implied-consent clients, allowing an attacker to approve device codes. By luring a logged-in user to a specially crafted page, an attacker can obtain access and ID tokens to make API calls on behalf of that user.

An open redirect and cross-site scripting issue exists that allows remote attackers to control destinations after login and logout. This is achieved by manipulating the `goto` and `gotoOnFail` parameters. Attackers can create malicious login or logout links to redirect users to phishing websites or execute scripts within the XUI to steal session cookies.

An open redirect issue exists because the `RelayState` is not validated when no `relayStateUrlList` is configured. This allows attackers to create single sign-on links containing a malicious `RelayState` to redirect users from the trusted origin to external phishing sites and bypass URL filters.

An open redirect exists because the WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and certain authentication pages fail to validate destination URLs against allowed lists. This allows attackers to create links using the OpenAM domain that redirect users to arbitrary external sites for phishing purposes.

An issue exists during self-registration where the system fails to enforce the Valid Creation Attributes list. This allows anonymous attackers to set restricted attributes, such as group membership, by using the legacy self-service REST endpoint or the User Self-Service flow. By manipulating these attributes, an attacker can join administrative groups and obtain full administrative control of the system.

An authentication bypass exists in the SAML v2.0 service provider. The system accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when the `WantAssertionsSigned` variable is set to false. This allows unauthenticated remote attackers to submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on access to dependent applications.

An information disclosure issue allows unauthenticated attackers to read live session tokens from the notification WebSocket. This is achieved by bypassing the agent-only check via an unvalidated internal forward on legacy Liberty ID-FF endpoints, enabling the collection of `iPlanetDirectoryPro` tokens to hijack user and administrator sessions.

An issue exists in the certificate CRL (Certificate Revocation List) checking process where the system fetches CRLs from the distribution point specified in a presented certificate without restricting the destination or verifying the signature of the downloaded CRL. This allows an attacker with a certificate chained to a trusted CA to force the server to make requests to internal hosts, capture CRL update credentials, overwrite stored revocation data to block authentication for that CA, and exhaust authentication threads.

Administrators, including delegated realm administrators, can trigger a server-side request forgery (SSRF) by providing arbitrary URLs through the federation configuration wizard metadata URLs. This allows the server to fetch content from internal hosts or cloud metadata endpoints, enabling the probing of internal networks and the reading of partial responses. This occurs when metadata or OpenID Connect discovery URLs are processed.

An issue exists where parties registering UMA resource sets can trigger internal requests via unvalidated scope description URLs. This occurs because the system fetches these URLs when sending pending-request notification emails. An attacker can provide URLs pointing to internal hosts or cloud metadata endpoints to perform internal network probing. Server-side request forgery (SSRF) is a flaw where a server is tricked into making requests to an unintended location.

OpenAM fails to verify that a signed SAML 1.x assertion or response was signed by the partner identified as its issuer. Instead, it accepts signatures from any certificate present in the OpenAM keystore. This allows an attacker possessing a private key from a trusted SAML 1.x partner to forge assertions that impersonate another partner's issuer, enabling unauthorized access as that partner's users, including those with privileged accounts.

A stored cross-site scripting issue exists where privileged attackers can inject scripts by placing markup in a user's display name. The script executes when a victim accesses the OAuth 2.0 / OpenID Connect consent page, potentially allowing the attacker to steal the OpenAM session cookie and impersonate the user.

An incomplete output encoding issue exists that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers who control a trusted identity provider can craft assertion attribute names or values that reach the target application in a modified form, which undermines the integrity of the received attributes.

An open redirect issue exists during SAML 1.x single sign-on due to loose trusted-partner destination matching. Remote attackers can craft malicious links to the '/SAMLAwareServlet' or '/SAMLPOSTProfileServlet' endpoints using a destination host that resembles a trusted partner, potentially redirecting authenticated users to phishing sites.

The software fails to enforce Proof Key for Code Exchange (PKCE), a security extension for OAuth 2.0, in the device authorization flow. Specifically, the system does not validate the code verifier during the exchange of device codes for tokens. This allows an attacker who obtains an approved device code from shared device storage or client logs to redeem it for ID and access tokens, enabling user impersonation.

An issue allows unauthenticated attackers to cause a denial of service by sending serialized Java data without size or structure limits, leading to server resource exhaustion. Attackers can send crafted requests to remote SDK endpoints, classic login pages, or the administration console to block session validation, authentication, and policy decisions.

The legacy JAX-RPC SOAP interface contains an unauthenticated arbitrary class instantiation flaw. Remote attackers can send SOAP requests to the endpoint '/jaxrpc/*' using an unverified session identifier and a specific class name. This can lead to server crashes, classpath probing, or potential remote code execution through gadget chains, which are sequences of existing code fragments used to achieve an unintended goal.

A cross-site scripting defect exists where the SAML message, relay state, and target URL are placed unencoded into the load-balancer cookie bounce auto-submit page. This issue is reachable when `cookieHashRedirectEnabled` is set, potentially allowing script execution in the OpenAM origin. However, an unrelated HTTP 500 failure prevents exploitation in released versions.