| 标题 | Cleo Harmony < 5.8.1.11 Authentication Bypass Issues |
|---|
| 描述 | SAML XML Signature Wrapping (XSW) leading to authentication bypass on Cleo Harmony
A holder of any IdP-signed SAML assertion at a federated tenant can wrap that assertion inside a forged <Response> carrying an arbitrary NameID/Subject / AttributeStatement, POST it to the SP's ACS, and receive an authenticated session as the spoofed identity. The signed assertion is preserved verbatim as a structural prop and the attacker's payload is the assertion the SP actually consumes after verification passes.
Reproduction:
1. Obtain any signed SAML response from the configured IdP for the target tenant. A normal SSO sign-in suffices.
2. Construct a wrapped response: keep the signed assertion as-is inside a `<saml:Extensions>` (or other unconsumed location); insert a sibling `<saml:Assertion>` carrying the attacker-chosen `<Subject><NameID>`, `Subject/SubjectConfirmation`, and any desired `<AttributeStatement>` (notably `Email`, since `LocalUserUtil.getNativeUserByAssertions` prefers the email attribute over `NameID`).
3. POST as `SAMLResponse=<base64>` to the ACS.
4. SP returns a `Set-Cookie: cleo.portal.sso_authentication=…` for the spoofed identity. Bearer JWT inside carries `sub` = attacker-chosen value. |
|---|
| 来源 | ⚠️ https://support.cleo.com/hc/en-us/articles/30258468834583-Cleo-Harmony-5-8-1-Release-Notes#Version58111 |
|---|
| 用户 | Anonymous User |
|---|
| 提交 | 2026-07-07 23時19分 (2 月前) |
|---|
| 管理 | 2026-09-01 09時20分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 397557 [Cleo Harmony 直到 5.8.1.10 SAML Authentication LocalUserUtil.getNativeUserByAssertions Email 弱身份验证] |
|---|
| 积分 | 20 |
|---|