Vulnerabilities

The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands.

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents.

The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration.

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly con…

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files.

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload.

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation.

The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field.

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration.

The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session.

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file.

A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privi…