CVE-2021-27582

Vulnerability

Overview

The OpenID Connect server implementation in MITREid Connect through version 1.3.3 contains a mass assignment (autobinding) vulnerability in the OAuthConfirmationController.java file [1][3]. This arises from unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow [2][3]. The Spring MVC framework automatically binds HTTP request parameters to Java objects, and here an attacker can supply extra HTTP parameters that become bound to the authorizationRequest object [2][3].

Attack

Vector and Exploitation

An attacker can exploit this by crafting a malicious authorization request to the server, adding unexpected HTTP parameters that the @ModelAttribute will bind to the model [1][2]. No prior authentication is required; the attacker only needs to trick a user (or the authorization endpoint) into processing a carefully constructed request [1][3]. The vulnerability is triggered during the standard OAuth/OpenID Connect authorization flow [1][3].

Impact

By over-posting additional parameters, the attacker can modify properties of the authorizationRequest object beyond what is normally allowed [2][3]. Depending on the exact fields present in the model, this could lead to bypass of authorization constraints, redirection of tokens or codes to attacker-controlled URIs, or other OAuth flow manipulation [1][3]. The root cause is the lack of input filtering on the parameters bound by @ModelAttribute [2][3].

Mitigation

Status

The vulnerability was publicly disclosed in February 2021 [3]. Users of MITREid Connect are advised to upgrade to a fixed version or apply a manual patch that restricts the set of HTTP parameters accepted by the @ModelAttribute method [2][3]. As of the publication date, no fix was released in the 1.3.3 version, and the project may be end-of-life, so migration to alternative solutions may be necessary [1][3].