GitHub Advisoryadvisory · Maven

GHSA-4mh8-9wq6-rjxg OpenAM vulnerable to user impersonation using SAMLv1.x SSO process

CRITICAL Published 2023-07-20 Modified 2023-07-20 Official page ↗
Aliases
CVE-2023-37471
Ecosystem
Maven
Packages
org.openidentityplatform.openam:openam-federation-library
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-287
Reviewed
2023-07-20

Affected packages

• Maven org.openidentityplatform.openam:openam-federation-library: < 14.7.3 → fixed in 14.7.3

Description

Impact OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. Patches This problem has been patched in OpenAM 14.7.3-SNAPSHOT and later Workarounds One should comment servlet `SAMLPOSTProfileServlet` in web.xml or disable SAML in OpenAM ```xml SAMLPOSTProfileServlet SAMLPOSTProfileServlet com.sun.identity.saml.servlet.SAMLPOSTProfileServlet ... SAMLSOAPReceiver /SAMLSOAPReceiver ``` References 624

Related

Alias · CVE (1)

  • CVE-2023-37471 Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References