Improper Authorization in OpenRemote Before 1.32.2

Executive Summary

OpenRemote before version 1.32.2 has an improper authorization flaw allowing realm administrators to access and modify global resources without super administrator checks. Attackers can change the global Keycloak URL via /configuration/manager to redirect authentication for other realms, enabling credential phishing, CSS injection, map tile replacement, and log deletion.

Useful 0 Not Useful 0

Detection Guidance

Check OpenRemote versions before 1.32.2 by running commands like 'docker ps' or 'curl http://localhost:8080/api/version' to identify vulnerable instances. Inspect logs for unauthorized access to /configuration/manager or admin endpoints. Monitor network traffic for unexpected redirects or authentication flows to untrusted Keycloak URLs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with realm admin access to manipulate global settings, steal credentials via phishing, inject malicious code into the UI, disrupt services by replacing map tiles, and delete logs to cover their tracks. It can also enable unauthorized access to other realms' data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to breaches of confidentiality and integrity, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Unauthorized access and data manipulation risks non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenRemote to version 1.32.2 or later immediately. Review and restrict access to /configuration/manager and other admin endpoints. Implement super administrator checks on all global resource modification endpoints. Monitor for suspicious activity such as CSS injection or map tile replacements.

Useful 0 Not Useful 0