CVE-2022-26493 miniOrange SAML Authentication Bypass
Attackers can bypass SAML authentication by removing signatures to impersonate users, including admins, in miniOrange Drupal modules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-26493?
CVE-2022-26493 is a critical authentication bypass vulnerability in Xecuify Drupal 7 miniOrange SAML SP, published on 3 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signature - impersonating existing users and existing roles, including administrative users/roles. This vulnerability is not mitigated by configuring the module to enforce signatures or certificate checks. Xecurify recommends updating miniOrange modules to their most recent versions. This vulnerability is present in paid versions of the miniOrange Drupal SAML SP product affecting Drupal 7, 8, and 9.
Weakness: CWE-295
Which versions are affected by CVE-2022-26493?
It affects 1 product.
Products include Drupal Saml Sp 2.0 Single Sign On.
How do I fix CVE-2022-26493?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-26493 being exploited?
There is no known exploitation of CVE-2022-26493 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2024-DI95704, GHSA-h8qj-jgxw-vqr8.