jkucve

Impact

What kind of vulnerability is it? Who is impacted?

This is related to CVE Remote code execution vulnerability in Microsoft.IdentityModel.Protocols.SignedHttpRequest.

Anyone leveraging the SignedHttpRequest Protocol or the SignedHttpRequestValidator classes, released in Microsoft.IdentityModel.Protocols.SignedHttpRequest is vulnerable. Microsoft.IdentityModel trusts the jku claim by default for the SignedHttpRequest protocol. This raises the possibility to make any remote or local HTTP GET request.

Workaround for teams who require this insecure pattern

Without upgrading you can disable or filter outbound http requests at the firewall. After upgrading if your service requires the use of the jku claim the only potentially safe way to do this is to limit the domains which you trust. Microsoft.IdentityModel.Protocols.SignedHttpRequest's SignedHttpRequestValidationParameters now exposes two new properties:

• AllowResolvingPopKeyFromJku which defaults to false and controls whether or not the PoP key can ever be resolved from the jku claim.
• If the above is ever set to true, you will also have to update the second new property, AllowedDomainsForJkuRetrieval which is the set of domains that you trust. Any domains in this list will be considered fully trusted as they can pass keys to influence PoP key validation.