CVE-2021-44878
📋 TL;DR
CVE-2021-44878 is an authentication bypass vulnerability in pac4j OpenID Connect implementation. It allows attackers to forge unsigned ID tokens using the 'none' algorithm, bypassing signature validation. This affects pac4j v5.3.0 and earlier when using OpenID Connect with providers that support the 'none' algorithm.
💻 Affected Systems
- pac4j
📦 What is this software?
Pac4j by Pac4j
Pac4j by Pac4j
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to protected resources and user impersonation.
Likely Case
Authentication bypass leading to unauthorized access to applications using pac4j for OpenID Connect authentication.
If Mitigated
No impact if proper signature validation is enforced and 'none' algorithm is explicitly rejected.
🎯 Exploit Status
Attack requires ability to intercept or modify authentication flow. Proof-of-concept code is available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.3.1 and later
Vendor Advisory: https://www.pac4j.org/blog/cve_2021_44878_is_this_serious.html
Restart Required: Yes
Instructions:
1. Update pac4j to version 5.3.1 or later. 2. Update dependencies in your project configuration. 3. Restart the application. 4. Verify the fix by testing authentication flows.
🔧 Temporary Workarounds
Explicitly reject 'none' algorithm
allConfigure pac4j to explicitly reject the 'none' algorithm in OpenID Connect configuration
Configure 'none' algorithm as not allowed in OpenID client configuration
Use only trusted OpenID providers
allConfigure pac4j to only accept tokens from providers that don't support 'none' algorithm
Restrict allowed OpenID providers in configuration
🧯 If You Can't Patch
- Implement additional token validation layer that rejects 'none' algorithm tokens
- Monitor authentication logs for suspicious 'none' algorithm usage and implement WAF rules to block such tokens
🔍 How to Verify
Check if Vulnerable:
Check if using pac4j version 5.3.0 or earlier with OpenID Connect. Test by attempting to authenticate with a token using 'alg': 'none' in header.Check Version:
Check project dependencies or Maven/Gradle configuration for pac4j versionVerify Fix Applied:
After updating to 5.3.1+, test authentication with 'none' algorithm token - it should be rejected. Verify configuration explicitly rejects 'none' algorithm.📡 Detection & Monitoring
Log Indicators:
- Authentication attempts with 'alg': 'none' in token headers
- Failed token validation logs
- Unexpected successful authentications
Network Indicators:
- Authentication requests with malformed tokens
- Traffic patterns showing authentication bypass
SIEM Query:
search 'alg":"none' OR 'authentication bypass' OR 'token validation failed' in application logs🔗 References
- https://github.com/pac4j/pac4j/commit/22b82ffd702a132d9f09da60362fc6264fc281ae
- https://openid.net/specs/openid-connect-core-1_0.html#IDToken
- https://www.pac4j.org/blog/cve_2021_44878_is_this_serious.html
- https://github.com/pac4j/pac4j/commit/22b82ffd702a132d9f09da60362fc6264fc281ae
- https://openid.net/specs/openid-connect-core-1_0.html#IDToken
- https://www.pac4j.org/blog/cve_2021_44878_is_this_serious.html
