CVE-2024-4399

The application does not validate the value of the passed parameter before executing a network request to the specified resource. An attacker, without needing any privileges, can provide a crafted parameter value pointing to internal infrastructure resources or external servers. The server then executes the request on behalf of the attacker, which can lead to information disclosure or interaction with resources not directly accessible from outside.

An attacker can gain access to internal network resources (e.g., services on the LAN, cloud environment metadata) and cause disclosure of sensitive information. The vulnerability can also be exploited to scan internal infrastructure or bypass perimeter security measures.

Patches available from the vendor should be applied according to the references. Additionally, it is recommended to implement firewall rules limiting the server's ability to initiate outgoing connections to internal network segments, and to verify and filter input parameters on the application side.

Apereo Central Authentication Service — versions indicated in vendor references