| Título | Cleo Harmony < 5.8.1.11 Authentication Bypass Issues |
|---|
| Descrição | SAML XML Signature Wrapping (XSW) leading to authentication bypass on Cleo Harmony
A holder of any IdP-signed SAML assertion at a federated tenant can wrap that assertion inside a forged <Response> carrying an arbitrary NameID/Subject / AttributeStatement, POST it to the SP's ACS, and receive an authenticated session as the spoofed identity. The signed assertion is preserved verbatim as a structural prop and the attacker's payload is the assertion the SP actually consumes after verification passes.
Reproduction:
1. Obtain any signed SAML response from the configured IdP for the target tenant. A normal SSO sign-in suffices.
2. Construct a wrapped response: keep the signed assertion as-is inside a `<saml:Extensions>` (or other unconsumed location); insert a sibling `<saml:Assertion>` carrying the attacker-chosen `<Subject><NameID>`, `Subject/SubjectConfirmation`, and any desired `<AttributeStatement>` (notably `Email`, since `LocalUserUtil.getNativeUserByAssertions` prefers the email attribute over `NameID`).
3. POST as `SAMLResponse=<base64>` to the ACS.
4. SP returns a `Set-Cookie: cleo.portal.sso_authentication=…` for the spoofed identity. Bearer JWT inside carries `sub` = attacker-chosen value. |
|---|
| Fonte | ⚠️ https://support.cleo.com/hc/en-us/articles/30258468834583-Cleo-Harmony-5-8-1-Release-Notes#Version58111 |
|---|
| Utilizador | Anonymous User |
|---|
| Submissão | 07/07/2026 23h19 (há 2 meses) |
|---|
| Moderação | 01/09/2026 09h20 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 397557 [Cleo Harmony até 5.8.1.10 SAML Authentication LocalUserUtil.getNativeUserByAssertions Email Autenticação fraca] |
|---|
| Pontos | 20 |
|---|