Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability involves how a federated identity system grants administrative privileges when configured in a specific way. When using a particular setup for external identity providers, authenticated users could potentially gain administrative access beyond what was intended, even if access was meant to be restricted. The main concern is confirming if this specific configuration is in use within your environment.
- Users might gain unintended admin access.
- Confirms specific federated access controls.
- Verify configuration to ensure proper access.
Attack Path
How an attacker could exploit the issue
An attacker could leverage a misconfigured federated OIDC provider to gain administrative privileges. This occurs when the provider uses a specific group mapping mode combined with a wildcard entry in the external groups whitelist. By exploiting this, an attacker could bypass intended access restrictions and obtain the `uaa.admin` scope, potentially leading to significant system compromise.
- Unrestricted OIDC provider access.
- OIDC group mapping with wildcard whitelist.
- Unauthorized administrative scope access.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow authenticated users to gain administrator privileges in the UAA service, bypassing intended access controls. This occurs when a specific configuration is used with an OIDC identity provider that maps external groups directly to scopes.
- UAA administrator scope.
- Improper OIDC group mapping.
- Unauthorized administrative access.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in federated OIDC authentication, specifically when using `groupMappingMode: AS_SCOPES` with a wildcard `externalGroupsWhitelist`, could allow unauthorized users to gain `uaa.admin` scope. Identifying where this OIDC configuration is deployed, confirming its reachability and criticality, and then coordinating with the relevant platform or security team is the critical first step.
- Platform and security teams should own.
- Verify OIDC group mapping configuration.
- Plan vendor coordination for fixes.
