CVE-2024-21643
📋 TL;DR
This vulnerability in Microsoft.IdentityModel allows attackers to make arbitrary HTTP GET requests by exploiting trust in the 'jku' claim within SignedHttpRequest protocol. It affects .NET applications using SignedHttpRequest or SignedHttpRequestValidator with vulnerable versions of Microsoft.IdentityModel extensions.
💻 Affected Systems
- Microsoft.IdentityModel.Protocols.SignedHttpRequest
- Microsoft.IdentityModel extensions for .NET
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Server-side request forgery (SSRF) enabling internal network reconnaissance, data exfiltration, or chaining with other vulnerabilities for remote code execution.
Likely Case
Unauthorized HTTP requests to internal services, potential data leakage, or denial of service through resource exhaustion.
If Mitigated
Limited impact if network segmentation restricts internal HTTP access and external requests are monitored.
🎯 Exploit Status
Requires ability to craft SignedHttpRequest tokens with malicious jku claims. Exploitation depends on application's token validation implementation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.34.0 or higher for 6.x, 7.1.2 or higher for 7.x
Vendor Advisory: https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-rv9j-c866-gp5h
Restart Required: Yes
Instructions:
1. Identify all applications using Microsoft.IdentityModel. 2. Update NuGet packages to Microsoft.IdentityModel.Protocols.SignedHttpRequest >=6.34.0 (6.x) or >=7.1.2 (7.x). 3. Update all dependent packages. 4. Rebuild and redeploy applications. 5. Restart application services.
🔧 Temporary Workarounds
Disable jku claim validation
allConfigure SignedHttpRequestValidator to not trust jku claims by default
// C# configuration example:
// In your token validation parameters:
// SignedHttpRequestValidationParameters.RequireSignedHttpRequest = true;
// SignedHttpRequestValidationParameters.ValidateJku = false;
🧯 If You Can't Patch
- Implement network controls to restrict outbound HTTP requests from affected applications
- Deploy web application firewall (WAF) rules to detect and block malicious jku claim patterns
🔍 How to Verify
Check if Vulnerable:
Check project dependencies for Microsoft.IdentityModel.Protocols.SignedHttpRequest version <6.34.0 (6.x) or <7.1.2 (7.x) using NuGet package manager or examining .csproj files.Check Version:
dotnet list package --include-transitive | findstr Microsoft.IdentityModel.Protocols.SignedHttpRequestVerify Fix Applied:
Confirm updated packages show version >=6.34.0 (6.x) or >=7.1.2 (7.x) in package references and validate application functionality with SignedHttpRequest.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP outbound requests from application servers
- Failed SignedHttpRequest validations with external jku URLs
- High volume of token validation requests
Network Indicators:
- HTTP GET requests to unexpected internal/external endpoints from application servers
- Patterns matching jku claim exploitation
SIEM Query:
source="application_logs" AND (message CONTAINS "jku" OR message CONTAINS "SignedHttpRequest") AND (status="failed" OR url="internal_network")🔗 References
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-rv9j-c866-gp5h
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/jkucve
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-rv9j-c866-gp5h
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/jkucve
