| Título | Cleo Harmony < 5.8.1.11 Authentication Bypass Issues |
|---|
| Descripción | SAML XML Signature Wrapping (XSW) leading to authentication bypass on Cleo Harmony
A holder of any IdP-signed SAML assertion at a federated tenant can wrap that assertion inside a forged <Response> carrying an arbitrary NameID/Subject / AttributeStatement, POST it to the SP's ACS, and receive an authenticated session as the spoofed identity. The signed assertion is preserved verbatim as a structural prop and the attacker's payload is the assertion the SP actually consumes after verification passes.
Reproduction:
1. Obtain any signed SAML response from the configured IdP for the target tenant. A normal SSO sign-in suffices.
2. Construct a wrapped response: keep the signed assertion as-is inside a `<saml:Extensions>` (or other unconsumed location); insert a sibling `<saml:Assertion>` carrying the attacker-chosen `<Subject><NameID>`, `Subject/SubjectConfirmation`, and any desired `<AttributeStatement>` (notably `Email`, since `LocalUserUtil.getNativeUserByAssertions` prefers the email attribute over `NameID`).
3. POST as `SAMLResponse=<base64>` to the ACS.
4. SP returns a `Set-Cookie: cleo.portal.sso_authentication=…` for the spoofed identity. Bearer JWT inside carries `sub` = attacker-chosen value. |
|---|
| Fuente | ⚠️ https://support.cleo.com/hc/en-us/articles/30258468834583-Cleo-Harmony-5-8-1-Release-Notes#Version58111 |
|---|
| Usuario | Anonymous User |
|---|
| Sumisión | 2026-07-07 23:19 (hace 2 meses) |
|---|
| Moderación | 2026-09-01 09:20 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 397557 [Cleo Harmony hasta 5.8.1.10 SAML Authentication LocalUserUtil.getNativeUserByAssertions Email autenticación débil] |
|---|
| Puntos | 20 |
|---|