PT-2022-17899 · Miniorange · Miniorange Drupal Saml Sp

Published 2022-06-03 · Updated 2022-07-03 · CVE-2022-26493

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions miniOrange Drupal SAML SP modules versions prior to the most recent versions Drupal SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider 8.x versions 8.x-2.24 and prior Drupal SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider 7.x versions 7.x-2.57 and prior

Description The issue allows an attacker with access to a HTTP-request intercepting method to bypass authentication and authorization by removing the SAML Assertion Signature, enabling them to impersonate existing users and roles, including administrative ones. This is possible even when the module is configured to enforce signatures or certificate checks.

Recommendations For miniOrange Drupal SAML SP modules, update to the most recent versions. For Drupal SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider 8.x, update to a version later than 8.x-2.24. For Drupal SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider 7.x, update to a version later than 7.x-2.57. As a temporary workaround, consider configuring the module to require x509 certificate and enabling the option to sign SAML assertions to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-26493

Affected Products

Miniorange Drupal Saml Sp

References · 4

• https://osv.dev/vulnerability/CVE-2022-26493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26493 · Security Note
• https://rafarmerjr1.github.io/2022/06/13/SAML-miniOrange.html · Note
• https://t.me/cibsecurity/43829 · Telegram Post