XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc

The XSS vulnerability arises when the OIDCPreservePost On directive is enabled within the modauthopenidc configuration. Attackers can exploit this by crafting malicious requests that inject JavaScript code into the OpenID Connect authentication flow. When a user subsequently authenticates, the injected script executes in their browser context, potentially allowing the attacker to steal cookies, redirect the user to a malicious site, or deface the web application. The blast radius extends to any user who authenticates through the vulnerable OpenID Connect integration.

Web applications using modauthopenidc for authentication with OpenID Connect, particularly those with the OIDCPreservePost On directive enabled, are at risk. Shared hosting environments where users can configure Apache modules are also vulnerable.

• apache / server:

grep -r 'OIDCPreservePost On' /etc/httpd/conf.d/*

• apache / server:

journalctl -u httpd | grep 'mod_auth_openidc'

1. 2021-07-26Disclosure

   disclosure

1. 已保留2021-05-12
2. 发布日期2021-07-26
3. 修改日期2024-08-03
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2021-32792 is to upgrade the modauthopenidc module to version 2.4.9 or later. If upgrading is not immediately feasible, consider disabling the OIDCPreservePost On directive in the Apache configuration. This will prevent the vulnerable code path from being executed, but may impact the functionality of the OpenID Connect integration. Monitor Apache access logs for unusual POST requests containing suspicious script tags. After upgrading, confirm the fix by attempting to trigger the XSS vulnerability with a crafted request and verifying that the script is not executed.