CVE-2024-41667 - CVE House

Back to Database

Status published High CVE-2024-41667

OpenAM FreeMarker template injection

8.8 CVSS

Vulnerability Description

OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to override the default OpenAM login, they did not restrict the `CustomLoginUrlTemplate`, allowing it to be set freely. Commit fcb8432aa77d5b2e147624fe954cb150c568e0b8 introduces `TemplateClassResolver.SAFER_RESOLVER` to disable the resolution of commonly exploited classes in FreeMarker template injection. As of time of publication, this fix is expected to be part of version 15.0.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-41667

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenIdentityPlatform

View All →

OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info

OpenDJ Denial of Service (Dos) using alias loop

User impersonation using SAMLv1.x SSO in Open Access Management

Affected Vendor

OpenIdentityPlatform

View all reports →

Affected Software

OpenAM

Vulnerable Versions:

< 15.0.4

Timeline

Official Publish: July 24th, 2024

Last Modified: August 6th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation