Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers can collect multiple client-side webflow execution tokens from the unauthenticated login page and perform known-plaintext analysis to decrypt the webflow conversation state due to keystream reuse caused by a fixed all-zero IV paired with the same encryption key.
AES-GCM requires a unique IV for each encryption operation performed with the same key — otherwise the keystream is identical for each message. Apereo CAS applies a fixed IV composed of all zeros throughout the server's lifetime, combined with the same encryption key. An attacker can collect multiple webflow execution tokens available without authentication on the login page, and then conduct analysis with knowledge of plaintext fragments (known-plaintext analysis). Due to keystream reuse, it is possible to decrypt the webflow conversation state (CWE-323: reuse of a nonce, key pair in encryption).
An attacker can read confidential data contained in the webflow conversation state (high system confidentiality), and combined with full knowledge of the session state, potentially manipulate authentication logic (high integrity). The vulnerability enables effective bypass of authentication mechanisms.
Apereo CAS must be updated to version 8.0.0-RC6 or later, in which the issue has been fixed (commit 22c6f4adf738852782309b523b4e80371057f2d0). Detailed information is available in the official producer security advisory and in the release information on GitHub.
Apereo CAS in versions from 7.3.0 to (but not including) 8.0.0-RC6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X