OpenAM Self-Registration Privilege Escalation via Attribute Manipulation

Executive Summary

OpenAM before version 16.1.4 has a flaw where the self-registration feature does not enforce the Valid Creation Attributes list. This allows anonymous attackers to set restricted attributes, including group membership, during registration. Attackers can exploit the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check OpenAM versions before 16.1.4 by running: curl -s http://<openam-server>/openam/json/serverinfo/* | grep version. Look for unauthorized administrative group memberships by reviewing user registration logs and group assignments in the OpenAM admin console.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to create an administrator account without authentication, gaining full control over OpenAM. This includes modifying configurations, creating further admin accounts, and accessing sensitive data. The attack requires no privileges or user interaction and can be performed remotely.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and privilege escalation, violating data protection requirements under GDPR and HIPAA. It may result in data breaches, unauthorized data access, or loss of audit controls, potentially leading to regulatory penalties and compliance failures.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenAM to version 16.1.4 or later. As a temporary workaround, disable self-registration or restrict access to the legacy self-service REST endpoint until the upgrade is completed.

Useful 0 Not Useful 0