CVE-2017-7662 Cross-Site Request Forgery in Apache CXF Fediz

High 8.8 Published 16 May 2017 Updated 5 Aug 2024

A CSRF vulnerability in the Apache CXF Fediz OIDC Client Registration Service allows attackers to create clients or reset secrets if an admin is logged in.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2017-7662?

CVE-2017-7662 is a high-severity vulnerability in Apache CXF Fediz, published on 16 May 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in this web application in Apache CXF Fediz prior to 1.4.0 and 1.3.2, meaning that a malicious web application could create new clients, or reset secrets, etc, after the admin user has logged on to the client registration service and the session is still active.

Weakness: CWE-352

Which versions are affected by CVE-2017-7662?

2 open source packages ship an affected version, including org.apache.cxf.fediz:fediz-oidc. It affects 1 product.

Package	Affected	Fixed in
`org.apache.cxf.fediz:fediz-oidc` Maven	All versions	`1.3.2`
`org.apache.cxf.fediz:fediz-oidc` Maven	All versions	`1.3.2`

Products include Apache Cxf Fediz.

How do I fix CVE-2017-7662?

Upgrade org.apache.cxf.fediz:fediz-oidc to 1.3.2 or later.

Is CVE-2017-7662 being exploited?

There is no known exploitation of CVE-2017-7662 in the wild and no public exploit code.

Sources

Also known as GHSA-f5ch-36rg-vfcc.