Email Content Injection in OpenAM

Executive Summary

OpenAM before version 16.1.3 has an email content injection flaw. Unauthenticated attackers can manipulate notification emails sent via the forgotPassword and register actions on the /json/{realm}/users endpoint. They can control email subject and message fields, enabling phishing emails to be sent from the organization's configured address or using the register function as a mail relay.

Useful 0 Not Useful 0

Detection Guidance

Check OpenAM version with curl -s http://your-openam-server/openam/version | grep -i version. If version is before 16.1.3, the system is vulnerable. Inspect network traffic for unusual SMTP connections from OpenAM server to external mail servers, especially to unknown recipients.

Useful 0 Not Useful 0

Impact Analysis

Attackers can send phishing emails that appear to come from your organization, tricking recipients into clicking malicious links or revealing sensitive information. The register action can be abused to send emails to arbitrary recipients, potentially spreading malware or conducting social engineering attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines or penalties for failing to protect user data from phishing attacks facilitated by this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenAM to version 16.1.3 or later immediately. Disable legacy self-service actions (forgotPassword and register) if not needed. Configure reverse proxy to strip caller-supplied email content. Rate-limit the affected endpoints to reduce abuse.

Useful 0 Not Useful 0