Jasig CAS Server up to 3.4.12.0/3.5.2.0 Google Account SamlUtils.java XML Data xml external entity reference

Summaryinfo

A vulnerability has been found in Jasig CAS Server up to 3.4.12.0/3.5.2.0 and classified as critical. Affected by this issue is some unknown functionality of the file java/org/jasig/cas/util/SamlUtils.java of the component Google Account Handler. Performing a manipulation as part of XML Data results in xml external entity reference. This vulnerability was named CVE-2014-2296. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Jasig CAS Server up to 3.4.12.0/3.5.2.0. This affects an unknown part of the file java/org/jasig/cas/util/SamlUtils.java of the component Google Account Handler. The manipulation as part of a XML Data leads to a xml external entity reference vulnerability. CWE is classifying the issue as CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Accounts Integration is enabled, allows remote unauthenticated users to bypass authentication via crafted XML data.

The bug was discovered 04/02/2014. The weakness was presented 07/20/2018 (Website). The advisory is shared at jasig.275507.n4.nabble.com. This vulnerability is uniquely identified as CVE-2014-2296 since 03/06/2014. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 1570 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 3.4.12.1 or 3.5.2.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Jasig

Name

• CAS Server

Version

• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.4.7
• 3.4.8
• 3.4.9
• 3.4.10
• 3.4.11
• 3.4.12.0
• 3.5.0
• 3.5.1
• 3.5.2.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion