Apache Syncope vulnerabilities

An incorrect authorization vulnerability in Apache Syncope affects the Reconciliation service (pull and push). Due to incomplete delegated administration security checks, calls by administrators lacking proper entitlements may be accepted, enabling unauthorized actions.

An incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing successful authentication and obtaining a valid low-privileges JWT.

Apache Syncope has an incorrect authorization vulnerability. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp.

Apache Syncope has an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters.

Apache Syncope has a missing authorization vulnerability. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities.

Apache Syncope has an incorrect authorization vulnerability. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for.

Apache Syncope has an incorrect authorization vulnerability. Search requests are transformed into SQL, Neo4J or Elasticsearch/Opensearch queries, and the Realms filter that should restrict results to the requester's permissions may be rendered as empty for non-recursive search requests, voiding privilege restrictions.

Apache Syncope has an improper privilege management vulnerability. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under which delegation management was granted.

Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA.

Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT.

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This may allow manipulation of graph database queries.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search.

An Improper Isolation or Compartmentalization vulnerability in Apache Syncope allows an administrator with adequate entitlements to create a malicious Groovy class containing untrusted code, bypassing the Groovy security sandbox.

An improper privilege management vulnerability exists in Apache Syncope. A user can exploit a REST API call to grant themselves administrative roles, gaining full control over the system. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

An SQL Injection vulnerability in Apache Syncope allows an administrator with adequate entitlements to execute arbitrary SQL via stacked queries using unsanitized sort parameters. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

An improper isolation or compartmentalization vulnerability exists in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors (REST and SQL) to run Groovy scripts.

A vulnerability in Apache Syncope allows improper isolation of Groovy scripts in BPMN processes. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and start them, causing the Groovy script to execute directly on the server without a sandbox.

Apache Syncope offers the ability to extend/customize the base behavior by allowing custom implementations of Java interfaces, including Groovy classes. It was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance.

An incorrect authorization vulnerability in Apache Syncope stems from flawed implementation of Realm hierarchy-based checks. Permission enforcement uses prefix matching, making it impossible to correctly distinguish between two sibling Realms whose names begin with the same string, leading to unauthorized access.

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula may be executed. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

An Open Redirect vulnerability in Apache Syncope affects the SRA (Syncope REST API) when configured for CAS authentication. The target Apereo CAS instance's URL is calculated unconditionally from client-supplied forwarded HTTP headers, allowing an attacker to control the redirect destination.

A vulnerability in Apache Syncope that involves insertion of sensitive information into sent data. Any authenticated user can query the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless of the caller's entitlements.

A cross-site scripting (XSS) vulnerability was found in Apache Syncope due to improper input neutralization during web page generation. The notification message shown on Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline via malicious HTTP link generation. Affects versions from 4.0.4 through 4.0.7 and from 4.1.0-M0 through 4.1.2.

In Apache Syncope, an administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression that allows any administrator with sufficient User read entitlements to access sensitive information of LinkedAccount or Manager, possibly including hashed credentials. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

In Apache Syncope, audit events sent to the configured store are not sufficiently masked for the sensitive values they might carry, allowing administrators to access such sensitive values. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

A vulnerability in Apache Syncope allows an administrator with adequate entitlements to access via REST the list of existing Access Tokens, including their signed JWT body. These tokens can then be used for further REST requests, impersonating users with higher administration privileges.

Insertion of sensitive information into log file vulnerability in Apache Syncope. When an AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters, and the resulting key value is logged.

An authenticated Server-Side Request Forgery (SSRF) vulnerability with low privileges was found in Apache Syncope via Connectors and Resources check. It allows an attacker to send requests from the server to internal systems.

Apache Syncope versions 3.0 to 3.0.16, 4.0 to 4.0.5, and 4.1.0 have a sensitive information disclosure vulnerability via malicious JEXL expressions in Derived Schemas. An administrator with sufficient entitlements can access user-related security-sensitive information.

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer. This affects versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0. Fixed in 4.0.6 and 4.1.1.