microsoft identitymodel-extensions CVE-2024-21643 is a vulnerability in Microsoft Identitymodel Extensions
Published on January 10, 2024

IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2024-21643 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

What is a Code Injection Vulnerability?

The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVE-2024-21643 has been classified to as a Code Injection vulnerability or weakness.


Products Associated with CVE-2024-21643

You can be notified by stack.watch whenever vulnerabilities like CVE-2024-21643 are published in these products:

Microsoft Identitymodel Extensions
 

What versions of Identitymodel Extensions are vulnerable to CVE-2024-21643?