Siemens Mendix SAML Module authentication replay

Summaryinfo

A vulnerability was found in Siemens Mendix SAML Module. It has been declared as critical. This affects an unknown function. Executing a manipulation can lead to authentication replay. This vulnerability is registered as CVE-2022-44457. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Siemens Mendix SAML Module (version now known). It has been declared as critical. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a authentication replay vulnerability. The CWE definition for the vulnerability is CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML Module (Mendix 7 compatible) (All versions >= V1.17.0), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML Module (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.2), Mendix SAML Module (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML Module (Mendix 9 compatible, New Track) (All versions >= V3.3.1 < V3.3.5), Mendix SAML Module (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0), Mendix SAML Module (Mendix 9 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.4). Affected versions of the module insufficiently protect from packet capture replay, only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled. This CVE entry describes the incomplete fix for CVE-2022-37011 in a specific non default configuration.

The weakness was published 11/08/2022 as ssa-638652. The advisory is shared for download at cert-portal.siemens.com. This vulnerability was named CVE-2022-44457 since 10/31/2022. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1040.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Siemens

Name

• Mendix SAML Module

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion