Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-21643

CVE-2024-21643: Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability

7.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-21643
GHSA ID
GHSA-rv9j-c866-gp5h
EPSS Score
0.69343%
CWE
CWE-94
Published
1/9/2024
Updated
2/5/2024
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
Microsoft.IdentityModel.Protocols.SignedHttpRequestnuget< 6.34.06.34.0
Microsoft.IdentityModel.Protocols.SignedHttpRequestnuget>= 7.0.0-preview, < 7.1.27.1.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the default trust of the 'jku' claim in the SignedHttpRequest validation process. The ValidateAsync() function in SignedHttpRequestValidator would handle this claim resolution, and prior to patched versions, it did not enforce domain restrictions or require explicit opt-in for 'jku' processing. The CWE-94 classification confirms this is a code injection vector via uncontrolled data (the 'jku' URL). The patch introduced 'AllowResolvingPopKeyFromJku' (default: false) and 'AllowedDomainsForJkuRetrieval' parameters, indicating the vulnerable code path was in the 'jku'-based key resolution logic within the validator.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t _W**t kin* o* vuln*r**ility is it? W*o is imp**t**?_ *nyon* l*v*r**in* t** `Si*n***ttpR*qu*st`proto*ol or t** `Si*n***ttpR*qu*stV*li**tor`is vuln*r**l*. Mi*roso*t.I**ntityMo**l trusts t** `jku`*l*im *y ****ult *or t** `Si*n***ttpR*qu*st`pr

Reasoning

T** vuln*r**ility st*ms *rom t** ****ult trust o* t** 'jku' *l*im in t** Si*n***ttpR*qu*st `v*li**tion` `pro**ss`. T** `V*li**t**syn*`() *un*tion in `Si*n***ttpR*qu*stV*li**tor` woul* **n*l* t*is *l*im r*solution, *n* prior to p*t**** v*rsions, it *i