CVE-2019-12419

Vulnerability

Analysis

CVE-2019-12419 is an improper authentication validation vulnerability in Apache CXF versions before 3.3.4 and 3.2.11. The flaw exists in the access token service components used for building OpenId Connect services. When processing token requests, the service does not verify that the authenticated principal matches the supplied clientId parameter.

Exploitation

To exploit this vulnerability, a malicious client must first obtain an authorization code that was issued to a different, legitimate client. This could potentially be achieved through cross-site scripting, open redirects, or other means of authorization code interception. Once the attacker possesses the stolen authorization code, they can present it along with their own client credentials, but using the victim's clientId. Because the service fails to enforce the binding between the authenticated principal and the clientId, the attacker can successfully redeem the authorization code for an access token intended for another client.

Impact

Successful exploitation allows an attacker to obtain a valid access token that belongs to a different client. Depending on the scope and permissions associated with that token, the attacker may then be able to access protected resources or impersonate the legitimate client. This essentially undermines the security of the OAuth2/OIDC flow, as the authorization code grant's fundamental assumption (that the party redeeming the code is the same one that initiated the request) is broken.

Mitigation

Apache has released patches in versions 3.3.4 and 3.2.11 which fix this validation issue [1]. Users of affected versions are strongly advised to upgrade immediately. There are no known workarounds for this vulnerability within the Apache CXF codebase; the fix requires updating the library.