OIDC Login CSRF in Leantime

Executive Summary

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters.

This flaw allows attackers to craft malicious callback URLs with attacker-controlled authorization codes.

As a result, attackers can perform session fixation by logging victims in as the attacker.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a Cross-Site Request Forgery (CSRF) attack in Leantime's OIDC login process due to missing state parameter verification. Detection would involve monitoring for suspicious or crafted callback URLs containing attacker-controlled authorization codes being accessed on your system.

You can detect potential exploitation attempts by inspecting web server logs for unusual OIDC callback requests that include unexpected or repeated authorization codes or state parameters.

Example commands to analyze logs might include:

• Using grep to find OIDC callback URL accesses in web server logs: grep 'oidc/callback' /var/log/nginx/access.log
• Searching for repeated or suspicious authorization codes: grep 'code=' /var/log/nginx/access.log | sort | uniq -c | sort -nr
• Monitoring active sessions for anomalies or unexpected user logins that could indicate session fixation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to session fixation attacks where an attacker forces a victim to use a session controlled by the attacker.

Victims may unknowingly be logged in as the attacker, potentially exposing sensitive information or allowing unauthorized actions under the victim's identity.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to perform session fixation by logging victims in as the attacker through a Cross-Site Request Forgery (CSRF) attack in the OIDC login process. This could lead to unauthorized access to user accounts and potentially sensitive information.

Such unauthorized access and session fixation attacks can undermine the confidentiality and integrity of user data, which are critical requirements under common standards and regulations like GDPR and HIPAA.

Therefore, if exploited, this vulnerability could result in non-compliance with these regulations due to failure to adequately protect user authentication and session management mechanisms.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been fixed in commit 9630eb7, which implements proper state parameter validation in the verifyState() method during the OIDC login process.

Immediate mitigation steps include:

• Update Leantime to the latest version that includes the fix from commit 9630eb7.
• Ensure that the generated state value is stored in the session during login initiation and validated against the state parameter received in the callback, rejecting any mismatches.
• Restrict access to the OIDC callback endpoint if possible, or monitor it closely for suspicious activity.
• Review and apply any security patches or updates provided by the Leantime project promptly.

Useful 0 Not Useful 0