CVE-2023-41890 Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation
Insufficient issuer validation in Sustainsys.Saml2 allows malicious providers or users to bypass authentication checks, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-41890?
CVE-2023-41890 is a high-severity authentication bypass vulnerability in Sustainsys Saml2, published on 19 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity provider to craft a Saml2 response that is processed as if issued by another identity provider. It is also possible for a malicious end user to cause stored state intended for one identity provider to be used when processing the response from another provider. An application is impacted if they rely on any of these features in their authentication/authorization logic: the issuer of the generated identity and claims; or items in the stored request state (AuthenticationProperties). This issue is patched in versions 2.9.2 and 1.0.3. The `AcsCommandResultCreated` notification can be used to add the validation required if an upgrade to patched packages is not possible.
Which versions are affected by CVE-2023-41890?
6 open source packages ship an affected version, including Sustainsys.Saml2 and Kentor.AuthServices. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Sustainsys.Saml2 NuGet | All versions | 1.0.3 |
Sustainsys.Saml2 NuGet | All versions | 1.0.3 |
Sustainsys.Saml2 NuGet | From 2.0.0 | 2.9.2 |
Sustainsys.Saml2 NuGet | From 2.0.0 | 2.9.2 |
Kentor.AuthServices NuGet | All versions to 0.23.0 | None |
Kentor.AuthServices NuGet | All versions to 0.23.0 | None |
Products include Sustainsys Saml2.
How do I fix CVE-2023-41890?
Upgrade Sustainsys.Saml2 to a fixed version for your release line: 1.0.3 or 2.9.2.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-41890 being exploited?
There is no known exploitation of CVE-2023-41890 in the wild and no public exploit code.
Other vulnerabilities in Sustainsys Saml2
Sources
Also known as GHSA-fv2h-753j-9g39.