PT-2022-16125 · Wire · Wire-Server

Published 2022-03-16 · Updated 2022-03-28 · CVE-2022-23610

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions wire-server versions prior to 2022-01-27

Description The issue allows an attacker to bypass SAML SSO and impersonate any Wire user with SAML credentials by crafting DSA Signatures. In teams with SAML but without SCIM, it is possible to create new accounts with fake SAML credentials. An upstream library for parsing, rendering, signing, and validating SAML XML data was accepting public keys as trusted that were provided by the attacker in the signature. To exploit this, the attacker needs to know the SSO login code, the SAML EntityID, and the SAML NameID of the user.

Recommendations For wire-server versions prior to 2022-01-27, update to version 2022-01-27 to resolve the issue. On premise instances of wire-server need to be updated to 2022-01-27. As a temporary workaround, consider restricting access to SAML SSO until the update is applied.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2022-23610

GHSA-9JG9-9G37-4424

Affected Products

Wire-Server

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23610.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-23610 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23610 · Security Note
• https://github.com/wireapp/wire-server/security/advisories/GHSA-9jg9-9g37-4424 · Note
• https://github.com/wireapp/wire-server/releases/tag/v2022-01-27 · Note