Vulnerability in VIP Authentication Hub (VIPAH) risk service for device recognition

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

Running a curl command to get the User risk score evaluation against VIP Authentication Hub, when the device signature ends with an extra "=" at the end of the value, then the UserRiskScoreEvaluator API always recognizes the device.

# curl --location 'https://vipauthhub.example.com/default/iarisk/v1/UserRiskScoreEvaluator' --header 'Accept: application/json' --header 'Content-Type: application/json' --header 'Authorization: <value>' --data '{<data>,"action":"SIGNIN","keyValuePair":[{"key":"deviceSignature","value":"<value>=="}]}'

  Response 

  {
              "key": "deviceSignature",
              "value": "<value>=="
  }

  {
      "risky": false,
      "eventId": "<eventid>",
  }

Environment

  VIP Authentication Hub 3.4.4;
  Openshift 4.16;

Cause

If the device gets recognized, the following key should show in the logs:

   {
     "key": "device.registered.reason",
     "value": "Registered device detected: registered device, effort=0"
   },

From the eventId value, this message cannot be found in the logs.

The value isn't recognized as a valid device, the VIP Authentication Hub skips the rule for validation, which is the problem.

This will be fixed in VIP Authentication Hub 3.5.

The fix makes VIP Authentication Hub trigger the risk rule rather than skipping the rule altogether, giving the impression that the device is recognized.

Resolution

Upgrade VIP Authentication Hub to 3.5 when this one is available.