CVE-2024-41667: OpenAM Template Injection Vulnerability

CVE-2024-41667 Overview

CVE-2024-41667 is a FreeMarker template injection vulnerability in OpenAM, an open access management solution maintained by the Open Identity Platform. The flaw resides in the getCustomLoginUrlTemplate method within RealmOAuth2ProviderSettings.java. The method processes user-controlled input as a FreeMarker template without restricting which classes can be resolved. An authenticated attacker with permission to configure the CustomLoginUrlTemplate can inject template expressions that resolve arbitrary Java classes, leading to remote code execution [CWE-94]. The issue affects OpenAM versions 15.0.3 and prior, with the fix expected in version 15.0.4.

Critical Impact
Authenticated attackers can achieve remote code execution on the OpenAM server by injecting FreeMarker template expressions through the custom login URL configuration.

Affected Products

Open Identity Platform OpenAM versions 15.0.3 and prior
OpenAM openam-oauth2 module (RealmOAuth2ProviderSettings.java)
Deployments exposing OAuth2 provider realm configuration

Discovery Timeline

2024-07-24 - CVE-2024-41667 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41667

Vulnerability Analysis

OpenAM allows administrators to override the default login flow by defining a custom login URL through the OAuth2 provider realm settings. The getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java compiles this value as a FreeMarker template. FreeMarker exposes reflective utilities such as freemarker.template.utility.ObjectConstructor and freemarker.template.utility.Execute that can instantiate arbitrary Java classes and invoke methods. Because the template value was not restricted, an attacker with configuration privileges could supply a payload that instantiates java.lang.Runtime and executes operating system commands. The resulting execution runs under the OpenAM service account, giving the attacker control over the identity provider and any credentials it stores.

Root Cause

The root cause is unsafe use of the FreeMarker template engine on attacker-controllable input without a restrictive TemplateClassResolver. The default resolver permits access to sensitive built-ins, enabling code injection through template syntax rather than restricting evaluation to data rendering.

Attack Vector

Exploitation requires network access to the OpenAM administrative interface and low-privileged authenticated access sufficient to modify the OAuth2 provider CustomLoginUrlTemplate setting. Once the malicious template is stored, subsequent login flows trigger evaluation of the injected FreeMarker expression, producing code execution on the server without further user interaction.

java

// Security patch applied in commit fcb8432aa77d5b2e147624fe954cb150c568e0b8
// File: openam-oauth2/src/main/java/org/forgerock/oauth2/core/RealmOAuth2ProviderSettings.java
 *
 * Copyright 2014-2016 ForgeRock AS.
 * Portions Copyrighted 2015 Nomura Research Institute, Ltd.
 * Portions Copyrighted 2024 3A Systems LLC.
 */

package org.forgerock.oauth2.core;

// The fix introduces TemplateClassResolver.SAFER_RESOLVER on the FreeMarker
// Configuration used to render CustomLoginUrlTemplate, disabling resolution
// of commonly exploited classes such as ObjectConstructor and Execute.

Source: OpenAM commit fcb8432aa77d5b2e147624fe954cb150c568e0b8

Detection Methods for CVE-2024-41667

Indicators of Compromise

Unexpected modifications to the OAuth2 provider CustomLoginUrlTemplate field containing FreeMarker directives such as <#assign>, ?new(, or references to freemarker.template.utility.Execute and ObjectConstructor.
Child processes spawned by the OpenAM Java process (for example sh, bash, cmd.exe, powershell.exe) that do not match legitimate deployment automation.
Outbound network connections from the OpenAM host to unrecognized IP addresses shortly after administrative configuration changes.

Detection Strategies

Audit OpenAM configuration change logs for updates to realm OAuth2 provider settings, prioritizing changes to CustomLoginUrlTemplate.
Correlate configuration changes with subsequent process execution or file writes by the OpenAM service account.
Inspect HTTP requests to OpenAM administrative endpoints for payloads containing FreeMarker syntax targeting reflective utilities.

Monitoring Recommendations

Forward OpenAM audit and access logs to a centralized log platform and alert on configuration changes to OAuth2 realm settings.
Monitor the OpenAM Java process for anomalous child processes and unexpected outbound connections.
Track administrative account activity, including new OAuth2 configurations pushed shortly after login events from unfamiliar sources.

How to Mitigate CVE-2024-41667

Immediate Actions Required

Upgrade OpenAM to version 15.0.4 or later once released, which applies TemplateClassResolver.SAFER_RESOLVER to the login URL template.
Review the current value of CustomLoginUrlTemplate across all realms and revert any unexpected FreeMarker content.
Restrict administrative access to OpenAM to trusted networks and rotate credentials for accounts able to modify OAuth2 provider settings.

Patch Information

The fix is delivered in commit fcb8432aa77d5b2e147624fe954cb150c568e0b8, which configures FreeMarker with TemplateClassResolver.SAFER_RESOLVER to block resolution of commonly abused classes. Details are documented in the GitHub Security Advisory GHSA-7726-43hg-m23v and the OpenAM patch commit. The fix is expected as part of OpenAM 15.0.4.

Workarounds

Remove or leave CustomLoginUrlTemplate unset in every OAuth2 provider realm until the patched release is deployed.
Limit accounts with realm configuration privileges to a small, audited group and require multi-factor authentication for administrative access.
Place OpenAM administrative endpoints behind a reverse proxy that filters requests containing FreeMarker directives targeting reflective classes.

bash

# Verify OpenAM version and inspect CustomLoginUrlTemplate values via ssoadm
ssoadm get-realm-svc-attrs \
    -e / \
    -s OAuth2Provider \
    -u amadmin \
    -f /path/to/pwd.txt | grep -i customLoginUrlTemplate

# If a non-empty value is found and not required, clear it:
ssoadm set-realm-svc-attrs \
    -e / \
    -s OAuth2Provider \
    -u amadmin \
    -f /path/to/pwd.txt \
    -a forgerock-oauth2-provider-custom-login-url-template=