Apache CloudStack up to 4.18.2.1/4.19.0.2 CloudStack SAML Authentication authentication spoofing

Summaryinfo

A vulnerability marked as critical has been reported in Apache CloudStack up to 4.18.2.1/4.19.0.2. Impacted is an unknown function of the component CloudStack SAML Authentication. Performing a manipulation results in authentication spoofing. This vulnerability is reported as CVE-2024-41107. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Apache CloudStack up to 4.18.2.1/4.19.0.2. This affects an unknown code of the component CloudStack SAML Authentication. The manipulation with an unknown input leads to a authentication spoofing vulnerability. CWE is classifying the issue as CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response with no signature and known or guessed username and other user details of a SAML-enabled CloudStack user-account. In such environments, this can result in a complete compromise of the resources owned and/or accessible by a SAML enabled user-account. Affected users are recommended to disable the SAML authentication plugin by setting the "saml2.enabled" global setting to "false", or upgrade to version 4.18.2.2, 4.19.1.0 or later, which addresses this issue.

The weakness was disclosed by Christian Gross as 4519. It is possible to read the advisory at lists.apache.org. This vulnerability is uniquely identified as CVE-2024-41107 since 07/13/2024. The exploitability is told to be difficult. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 4.18.2.2 or 4.19.1.0 eliminates this vulnerability. The upgrade is hosted for download at cloudstack.apache.org.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Apache

Name

• CloudStack

Version

• 4.18.2.0
• 4.18.2.1
• 4.19.0.0
• 4.19.0.1
• 4.19.0.2

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion