OpenAM vulnerabilities

In OpenAM prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1.

In OpenAM versions prior to 16.0.0, if the "claims_parameter_supported" parameter is enabled, the "oidc-claims-extension.groovy" script allows injecting an arbitrary value into a claim in the id_token or user_info. An authorize request can include a claims parameter containing JSON that lets attackers customize returned claims. Version 16.0.0 fixes the issue.

OpenAM (OpenAM Consortium Edition) versions 14.0.0 through 14.0.1 contain a vulnerability that may cause it to malfunction as a SAML IdP due to a tampered request. The issue affects versions 14.0.0 through 14.0.1.