OpenAM Fixes Template Injection Vulnerability

CVE-2024-41667

What is CVE-2024-41667?

OpenAM, an access management solution by OpenIdentity Platform, is susceptible to a template injection vulnerability. This issue arises from the insecure handling of user input in the getCustomLoginUrlTemplate method within the RealmOAuth2ProviderSettings.java file. In versions prior to 15.0.4, attackers can manipulate the CustomLoginUrlTemplate, which is intended for defining a custom login URL, to inject malicious templates. A fix was introduced in commit fcb8432aa77d5b2e147624fe954cb150c568e0b8 to implement the TemplateClassResolver.SAFER_RESOLVER, limiting the resolution of widely exploited classes, thus improving the security posture of the product. Users are advised to update their installations to version 15.0.4 or later to mitigate this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References