[Security:high] oidc authorization codes are not tied to their RP
Configure two OIDC relaying parties
- rp1, allowed to all users
- rp2, restricted to admins through a security rule in LLNG
Then, as any user, obtain an OIDC authorization code for rp1, using rp2's redirect_uri
You can use this code to access rp2 without being admin
That happens because we haven't implemented this part of the OIDC spec:
OpenID Connect spec, 18.104.22.168. Token Request Validation
Ensure the Authorization Code was issued to the authenticated Client.
Authorization bypass on OIDC services, on applications that do not perform their own access control.
In order to be vulnerable, rp1 must not have any declared redirect URIs
We should store the client_id in the code session and verify it before emitting an access token