Unauthenticated Access in OpenAM Built-in Identities

Executive Summary

OpenAM versions before 16.1.4 have built-in accounts (demo, anonymous, wsc, wsp, SecurityTokenService, agentAuth) with identical default passwords across all installations. These passwords are publicly known, allowing unauthenticated remote attackers to log in and obtain authenticated sessions. The agent accounts can also read other agent profiles' configurations.

Useful 0 Not Useful 0

Detection Guidance

Check OpenAM logs for successful logins using default accounts like demo, anonymous, wsc, wsp, SecurityTokenService, or agentAuth. Inspect network traffic for unauthenticated access attempts to OpenAM endpoints. Verify if default passwords are still active by attempting to log in with these credentials.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to gain unauthorized access to OpenAM systems, potentially leading to data breaches, configuration exposure, or further attacks. The vulnerability acts as an entry point for intrusions, though built-in accounts lack admin privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for secure authentication and access control, such as GDPR's data protection principles or HIPAA's security rules, due to the use of default credentials and lack of proper access restrictions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenAM to version 16.1.4 or later to deactivate default accounts and enable account lockout. Remove or secure default accounts with strong passwords. Disable module-based authentication if not required. Enable account lockout policies to prevent brute force attacks.

Useful 0 Not Useful 0