Horizon Alert
Summary of the vulnerability and why it matters
This advisory addresses a vulnerability in OpenAM that could allow attackers to steal active user session tokens from a notification channel. By exploiting this, an attacker might impersonate legitimate users or administrators to gain unauthorized access to systems. The main concern is confirming relevance and exposure within your environment.
- Steals active user session tokens.
- Matters for protecting user and admin access.
- Confirm if your systems are exposed.
Attack Path
How an attacker could exploit the issue
Attackers can exploit an information disclosure vulnerability in OpenAM by accessing its notification WebSocket to steal live session tokens. This is achieved by bypassing agent-only checks via unvalidated internal forwards on specific legacy endpoints, allowing the attacker to collect iPlanetDirectoryPro tokens. These tokens can then be used to hijack user and administrator sessions.
- Publicly accessible endpoint required.
- Unvalidated forward to notification WebSocket.
- Hijack user and administrator sessions.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could expose live user session tokens, potentially allowing attackers to impersonate users and administrators. This could occur when an attacker bypasses agent-only checks through specific legacy endpoints, gaining access to the notification WebSocket.
- User and administrator session tokens at risk.
- Access via unvalidated internal forwards.
- Session hijacking leading to unauthorized access.
Operational Fix
Recommended remediation, mitigation, and detection steps
Given the critical nature of this information disclosure in OpenAM, the platform or infrastructure team responsible for managing the identity and access management solution should take the lead. The first critical step is to identify all instances of the affected OpenAM deployment, confirm their external reachability and business criticality, and then ascertain the specific asset owner to coordinate remediation efforts.
- Identify affected OpenAM deployments.
- Confirm reachability and business criticality.
- Plan remediation with accountable owner.
