Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.openidentityplatform.openam:openam-oauth2 | maven | >= 13.0.0, <= 16.1.1 | 16.1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability is a reflected Cross-Site Scripting (XSS) issue on the OAuth2/OIDC wap consent page in OpenAM. The root cause is that several parameters from the authorization request, such as response_type, client_id, and scope names, were being rendered directly into the HTML of the consent page without proper HTML escaping.
The analysis of the patch 98cee2dfe701c2e16e5bcee34e6fd9d913925118 confirms this. The changes in openam-oauth2/src/main/resources/templates/wap/authorize.ftl involve adding ?html escaping to multiple variables (target, r from the display_scope loop, response_type, client_id). This is a clear indication that these values were previously vulnerable to XSS.
The Java code changes in openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/ConsentRequiredResource.java show how the data for this template is prepared. The addDisplayScopesAndClaims method is modified to populate a list of scope names (display_scope) that is then used by the vulnerable template. This method is called by getDataModel, which is the primary function responsible for collecting all the data to be rendered. An attacker could craft a malicious authorization URL containing script payloads in the vulnerable parameters. When a victim visits this URL, the ConsentRequiredResource.getDataModel function would process these parameters and pass them unescaped to the template, leading to the execution of the attacker's script in the victim's browser within the security context of the OpenAM domain.
org.forgerock.oauth2.restlet.ConsentRequiredResource.getDataModelopenam-oauth2/src/main/java/org/forgerock/oauth2/restlet/ConsentRequiredResource.java
org.forgerock.oauth2.restlet.ConsentRequiredResource.addDisplayScopesAndClaimsopenam-oauth2/src/main/java/org/forgerock/oauth2/restlet/ConsentRequiredResource.java