| 제목 | Cleo Harmony < 5.8.1.11 Authentication Bypass Issues |
|---|
| 설명 | SAML XML Signature Wrapping (XSW) leading to authentication bypass on Cleo Harmony
A holder of any IdP-signed SAML assertion at a federated tenant can wrap that assertion inside a forged <Response> carrying an arbitrary NameID/Subject / AttributeStatement, POST it to the SP's ACS, and receive an authenticated session as the spoofed identity. The signed assertion is preserved verbatim as a structural prop and the attacker's payload is the assertion the SP actually consumes after verification passes.
Reproduction:
1. Obtain any signed SAML response from the configured IdP for the target tenant. A normal SSO sign-in suffices.
2. Construct a wrapped response: keep the signed assertion as-is inside a `<saml:Extensions>` (or other unconsumed location); insert a sibling `<saml:Assertion>` carrying the attacker-chosen `<Subject><NameID>`, `Subject/SubjectConfirmation`, and any desired `<AttributeStatement>` (notably `Email`, since `LocalUserUtil.getNativeUserByAssertions` prefers the email attribute over `NameID`).
3. POST as `SAMLResponse=<base64>` to the ACS.
4. SP returns a `Set-Cookie: cleo.portal.sso_authentication=…` for the spoofed identity. Bearer JWT inside carries `sub` = attacker-chosen value. |
|---|
| 원천 | ⚠️ https://support.cleo.com/hc/en-us/articles/30258468834583-Cleo-Harmony-5-8-1-Release-Notes#Version58111 |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 07. 07. PM 11:19 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 01. AM 09:20 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397557 [Cleo Harmony 까지 5.8.1.10 SAML Authentication LocalUserUtil.getNativeUserByAssertions Email 약한 인증] |
|---|
| 포인트들 | 20 |
|---|