GitHub Advisoryadvisory · Maven

GHSA-4m6j-23p2-8c54 Armeria SAML authentication bypass due to missing validation on unsigned SAML messages

CRITICAL Published 2024-02-26 Modified 2024-02-26 Official page ↗
Aliases
CVE-2024-1735
Ecosystem
Maven
Packages
com.linecorp.armeria:armeria-saml
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-304
Reviewed
2024-02-26

Affected packages

• Maven com.linecorp.armeria:armeria-saml: < 1.27.2 → fixed in 1.27.2

Description

Impact The SAML implementation provided by `armeria-saml` currently accepts unsigned SAML messages (assertions, logout requests, etc.) as they are, rather than rejecting them by default. As a result, an attacker can forge a SAML message to authenticate themselves, despite the fact that such an unsigned SAML message should be rejected. Patches The vulnerability has been patched in Armeria version 1.27.2. All users who rely on `armeria-saml` older than version 1.27.2 must upgrade to 1.27.2 or later. Workarounds There is no known workaround for this vulnerability. References `SamlMessageUtil.validateSignature()`

Related

Alias · CVE (1)

  • CVE-2024-1735 A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass… vulnerability

Weakness · CWE (1)

  • CWE-304 Missing Critical Step in Authentication weakness

References