CVE-2024-41107 Apache CloudStack: SAML Signature Exclusion
Attackers can bypass SAML authentication in Apache CloudStack by submitting unsigned responses, leading to account takeover if SAML is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-41107?
CVE-2024-41107 is a high-severity authentication bypass vulnerability in Apache Cloudstack, published on 19 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response with no signature and known or guessed username and other user details of a SAML-enabled CloudStack user-account. In such environments, this can result in a complete compromise of the resources owned and/or accessible by a SAML enabled user-account.
Affected users are recommended to disable the SAML authentication plugin by setting the "saml2.enabled" global setting to "false", or upgrade to version 4.18.2.2, 4.19.1.0 or later, which addresses this issue.
Weakness: CWE-290
Which versions are affected by CVE-2024-41107?
It affects 1 product.
Products include Apache Cloudstack.
How do I fix CVE-2024-41107?
No fix has been published for CVE-2024-41107 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-41107 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-41107 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Cloudstack
- CVE-2012-4501 Missing authorization in n/a
- CVE-2024-38346 Apache CloudStack: Unauthenticated cluster service port leads to remote execution
- CVE-2024-39864 Apache CloudStack: Integration API service uses dynamic port when disabled
- CVE-2024-29006 Apache CloudStack: x-forwarded-for HTTP header parsed by default
- CVE-2022-35741 Apache CloudStack SAML Single Sign-On XXE
Sources
Also known as GHSA-gmm6-5xx7-57r6.