Account Provisioning Vulnerability in WSO2 Identity Server

CVE-2024-1524

What is CVE-2024-1524?

The WSO2 Identity Server's Silent Just-In-Time (JIT) Provisioning feature poses a security risk by allowing malicious actors to overwrite information of local user accounts during the provisioning process. This occurs when a federated user shares the same username with a local user, enabling the potential association of the malicious user's federated account with a targeted local account. This vulnerability necessitates a specific deployment scenario, including an enabled federated authentication IDP using Silent JIT provisioning, a valid federated user account that shares a username with a local user, and prior knowledge of the local user's valid username.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References