CVE-2021-26715 Server Side Request Forgery (SSRF) in org.mitre:openid-connect-server

What is CVE-2021-26715?

CVE-2021-26715 is a critical server-side request forgery vulnerability in n/a, published on 25 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network.

Weakness: CWE-918

Which versions are affected by CVE-2021-26715?

2 open source packages ship an affected version, including org.mitre:openid-connect-server. It affects 1 product.

Products include Mitreid Connect.

How do I fix CVE-2021-26715?

No fix has been published for CVE-2021-26715 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2021-26715 being exploited?

There is no known exploitation of CVE-2021-26715 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-27582 Autobinding vulnerability in MITREid Connect Critical 9.1
• CVE-2020-5497 XSS in MITREid Connect Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-792r-mh2q-p8qp.