How to remediate – OpenID Connect Anonymous Account

1. Introduction

OpenID Connect Anonymous Account refers to a potential issue where an attacker can determine if an anonymous account exists on a server using the `/.well-known/webfinger` endpoint of OpenID Connect. This is concerning because it allows unauthenticated access, potentially enabling further attacks. Systems utilising OpenID Connect for authentication are usually affected. A successful exploit could lead to compromised confidentiality, integrity and availability.

2. Technical Explanation

OpenID Connect builds on OAuth 2.0 to provide an identity layer. The `/.well-known/webfinger` endpoint is used to discover information about OpenID Connect providers. If not properly secured, this endpoint can reveal the existence of anonymous accounts. An attacker could then attempt to log in using these credentials.

• Root cause: Lack of restriction on access to the `/.well-known/webfinger` endpoint, allowing unauthenticated users to query for account information.
• Exploit mechanism: An attacker sends an HTTP request to the `/.well-known/webfinger` endpoint and parses the response to identify potential anonymous accounts. They then attempt to authenticate using these discovered credentials. For example, a simple GET request could reveal user identifiers.
• Scope: OpenID Connect implementations across various platforms and products are affected if not configured correctly.

3. Detection and Assessment

You can check for this vulnerability by examining the accessibility of the `/.well-known/webfinger` endpoint and reviewing responses for anonymous account indicators.

• Quick checks: Use a web browser or command line tool like curl to access the `/.well-known/webfinger` endpoint on your OpenID Connect server.
• Scanning: Nessus plugin ID 16583 may detect this issue, but results should be manually verified.
• Logs and evidence: Check web server logs for requests to the `/.well-known/webfinger` endpoint from unauthenticated sources.

curl -I https://your-openid-connect-server/.well-known/webfinger

4. Solution / Remediation Steps

The following steps outline how to mitigate the risk of anonymous account access via the OpenID Connect `/.well-known/webfinger` endpoint.

4.1 Preparation

• Ensure you have access to revert the configuration if issues arise. A roll back plan involves restoring the previous snapshot or configuration file.
• Consider a change window and obtain approval from relevant stakeholders.

4.2 Implementation

1. Step 1: Restrict access to the `/.well-known/webfinger` endpoint to authenticated users only. This can typically be done through web server configuration or OpenID Connect provider settings.
2. Step 2: Review your OpenID Connect provider’s documentation for specific guidance on securing this endpoint.

4.3 Config or Code Example

Before

# Apache example - allowing access from all sources
<Location / .well-known/webfinger>
  Require all granted
</Location>

After

# Apache example - restricting access to authenticated users only
<Location / .well-known/webfinger>
  Require valid-user
</Location>

4.4 Security Practices Relevant to This Vulnerability

List only practices that directly address this vulnerability type. Use neutral wording and examples instead of fixed advice. For example: least privilege, input validation, safe defaults, secure headers, patch cadence. If a practice does not apply, do not include it.

• Practice 1: Least privilege – restrict access to sensitive endpoints like `/.well-known/webfinger` to only authenticated users who require it.

4.5 Automation (Optional)

# Example Ansible task to restrict access using Apache's .htaccess file
- name: Restrict access to /.well-known/webfinger
  copy:
    dest: /etc/apache2/.htaccess
    content: "<Location / .well-known/webfinger>n Require valid-usern</Location>"
    owner: root
    group: root
    mode: 0644
  notify: Restart Apache

5. Verification / Validation

Confirm the fix by attempting to access the `/.well-known/webfinger` endpoint without authentication and verifying that you are prompted for credentials.

• Post-fix check: Use curl -I https://your-openid-connect-server/.well-known/webfinger. The response should return a 401 Unauthorized status code.
• Re-test: Repeat the initial detection method (accessing the endpoint) and confirm that it now requires authentication.
• Monitoring: Monitor web server logs for failed access attempts to the `/.well-known/webfinger` endpoint from unauthenticated sources as an indicator of potential attacks.

curl -I https://your-openid-connect-server/.well-known/webfinger

6. Preventive Measures and Monitoring

Update security baselines to include restrictions on access to sensitive endpoints like `/.well-known/webfinger`. Implement checks in your CI/CD pipeline to ensure that new deployments adhere to these baselines.

• Baselines: Update a security baseline or policy to require authenticated access for the `/.well-known/webfinger` endpoint.
• Pipelines: Add static analysis tools (SAST) to your CI/CD pipeline to detect insecure configurations like open access to sensitive endpoints.
• Asset and patch process: Regularly review OpenID Connect server configurations as part of a vulnerability management program.

7. Risks, Side Effects, and Roll Back

Restricting access to the `/.well-known/webfinger` endpoint could potentially disrupt automated discovery processes if not configured carefully.

• Roll back: Restore the previous web server configuration file, removing the restrictions on access to the `/.well-known/webfinger` endpoint. Restart the web server.

8. References and Resources

• Vendor advisory or bulletin: https://openid.net/specs/openid-connect-discovery-1_0.html