I've quoted the email below from the CAS mailing list.
From: Marvin Addison marvin.addison@gmail.com
Subject: [cas-announce] CAS Client Security Vulnerability CVE-2014-4172
Date: August 11, 2014 at 11:03:48 AM CDT
To: cas-announce@lists.ja-sig.org
A critical security vulnerability has been discovered in several Jasig
CAS clients that allows URL parameter injection due to improper URL
encoding at the back-channel ticket validation step of the CAS
protocol. The following CVE number has been assigned to track this
vulnerability:
There may be other CAS clients that are vulnerable.
Impact
The nature of the vulnerability allows malicious remote (network)
agents to craft attack URLs that bypass security constraints of the
CAS protocol. The following attack scenarios are known and have been
demonstrated:
A malicious service that can obtain a valid ticket can use it to
access another service in violation of the CAS protocol requirement
that a ticket issued for a service can only be used to access the
service for which the ticket was granted. This type of access amounts
to an illicit proxy: the attacker is proxying authentication for the
target.
A malicious user can request a ticket for service A and use it to
access service B with the access privileges of A.
Attacks like scenario 1 could result in unauthorized data disclosure,
while scenario 2 could result in privilege escalation. Other attack
scenarios may be possible.
Remediation
Upgrade affected CAS clients as soon as possible. Consider mitigation
if upgrading is not possible.
Mitigation
The CAS Service Management facility [1], which is enabled by default,
can be used to restrict services that are permitted to use CAS (i.e.
allowed to request tickets). Whitelisting trusted services can reduce
the scope of attacks like scenario 1 above.
The following servlet filter may provide additional defense at the CAS
server against some forms of this attack:
I've quoted the email below from the CAS mailing list.