CVE-2024-21643CWE-94

Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability

High · published January 10, 2024

CVSS v3.1
7.1
EPSS
2%
Percentile
82.6
In the wild
Unconfirmed
What it is

IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.02233 · 82.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-01-10T04:13Z
EPSS history
Timeline
  • 10 JAN 04:13Z
    Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability
    cvelistv5