AdNovum nevisAuth up to 4.18.3.0 SAML 2.0 improper authentication

Summaryinfo

A vulnerability categorized as critical has been discovered in AdNovum nevisAuth up to 4.18.3.0. The affected element is an unknown function of the component SAML 2.0 Handler. Such manipulation leads to improper authentication. This vulnerability is listed as CVE-2015-5372. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in AdNovum nevisAuth up to 4.18.3.0. It has been rated as critical. Affected by this issue is an unknown functionality of the component SAML 2.0 Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The SAML 2.0 implementation in AdNovum nevisAuth 4.13.0.0 before 4.18.3.1, when using SAML POST-Binding, does not match all attributes of the X.509 certificate embedded in the assertion against the certificate from the identity provider (IdP), which allows remote attackers to inject arbitrary SAML assertions via a crafted certificate.

nevisAuth implements strong user and system authentication for identity and access management solutions. It offers secure execution of multi-step authentication and is able to dynamically adjust authentication strengths. nevisAuth is highly flexible, easily integrated and supports plug-ins to various authentication methods.

The bug was discovered 06/26/2015. The weakness was presented 09/21/2015 by Antoine Neuenschwander and Roland Bischofberger with CSNC as SAML SP Authentication Bypass in nevisAuth as confirmed posting (Bugtraq). The advisory is shared for download at securityfocus.com. The public release was coordinated in cooperation with the vendor. This vulnerability is handled as CVE-2015-5372 since 07/06/2015. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The advisory points out:

When configured as a SAML 2.0 service provider (SP), nevisAuth authenticates users based on security assertions issued and signed by a trusted identity provider (IdP). An assertion contains various fields about the user or subject being authenticated, e.g. a name identifier (NameID), various attributes and timestamps. Trust is based on the IdP's certificate, which is used to validate the digital signature of security assertions. In a setup where security assertions are conveyed via User-Agent (i.e when using HTTP POST Binding), it is possible to forge and inject new assertions based on data intercepted during a valid past authentication process. To achieve this, the signing certificate is extracted from the assertion and then cloned to reflect all X.509 data fields. A new public/private key pair is generated. The public key is inserted into the certificate and the private key is used to sign it. The signing certificate in the security assertion is now replaced with its rogue copy. The attacker can then modify arbitrary values of the assertion, for example the NameID. Finally, the assertion is signed with the cloned certificate.

The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $25k-$100k. The advisory illustrates:

This vulnerability was discovered using the SAMLRaider Plugin for Burp Suite (...)

Upgrading to version 4.18.3.1 eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability. The posting contains the following remark:

Alternatively, when using HTTP POST Binding, use encrypted security assertions for transmission via the User-Agent. Or completely avoid transmitting security assertions over insecure channels by using HTTP Artifact Binding.

packetstormsecurity.com is providing further details. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• AdNovum

Name

• nevisAuth

Version

• 4.18.0
• 4.18.1
• 4.18.2
• 4.18.3.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion