GHSA-hx5q-v6pj-533r SAML authentication bypass due to missing validation on unsigned SAML messages
Attackers can bypass authentication by forging unsigned SAML messages in Central Dogma when SAML is enabled, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-hx5q-v6pj-533r?
GHSA-hx5q-v6pj-533r is an authentication bypass vulnerability in com.linecorp.centraldogma:centraldogma-server-auth-saml, published on 26 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
When SAML is used as the authentication mechanism, Central Dogma accepts unsigned SAML messages (assertions, logout requests, etc.) as they are, rather than rejecting them by default. As a result, an attacker can forge a SAML message to authenticate themselves, despite the fact that such an unsigned SAML message should be rejected.
Patches
The vulnerability has been patched in Central Dogma 0.64.3 by updating its Armeria dependency to 1.27.2. All users who use SAML as the authentication mechanism must upgrade from 0.64.3 or later.
Workarounds
A user can manually upgrade the armeria-saml module with the one from Armeria 1.27.2 or later, either by replacing the JAR in the Central Dogma distribution or by updating the dependency tree of the build.
References
Which versions are affected by GHSA-hx5q-v6pj-533r?
2 open source packages ship an affected version, including com.linecorp.centraldogma:centraldogma-server-auth-saml.
| Package | Affected | Fixed in |
|---|---|---|
com.linecorp.centraldogma:centraldogma-server-auth-saml Maven | All versions | 0.64.3 |
com.linecorp.centraldogma:centraldogma-server-auth-saml Maven | All versions | 0.64.3 |
How do I fix GHSA-hx5q-v6pj-533r?
Upgrade com.linecorp.centraldogma:centraldogma-server-auth-saml to 0.64.3 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-hx5q-v6pj-533r being exploited?
There is no known exploitation of GHSA-hx5q-v6pj-533r in the wild and no public exploit code.