PT-2024-32842 · Ssoready+1 · Ssoready+1

Ahacker1-Securesaml · Published 2024-10-09 · Updated 2024-11-05 · CVE-2024-47832

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SSOReady versions prior to 7f92a06

Description The issue concerns XML signature bypass attacks. An attacker can exploit differential behavior between XML parsers to carry out signature bypass if they have access to certain IDP-signed messages. Users of the public hosted instance of SSOReady are unaffected. The vulnerability was discovered by a security researcher and its precise mechanism is not publicly disclosed to prevent potential attacks on other SAML implementations.

Recommendations To resolve the issue, upgrade to SSOReady version 7f92a06 or later by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2024-47832

GHSA-J2HR-Q93X-GXVH

GO-2024-3185

OPENSUSE-SU-2024:0350-1

OPENSUSE-SU-2024:14447-1

OPENSUSE-SU-2024_3911-1

SUSE-SU-2024:3911-1

Affected Products

Ssoready

Suse

References · 77

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47832.json · Exploit
• https://github.com/ssoready/ssoready/commit/7f92a0630439972fcbefa8c7eafe8c144bd89915 · Patch
• https://github.com/ssoready/ssoready/security/advisories/GHSA-j2hr-q93x-gxvh · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j2hr-q93x-gxvh · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0350-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47832 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14447-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47832 · Security Note
• https://osv.dev/vulnerability/GO-2024-3185 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3911-1 · Vendor Advisory
• https://github.com/ssoready/ssoready · Note
• https://suse.com/security/cve/CVE-2024-9180 · Note
• https://suse.com/security/cve/CVE-2024-47003 · Note
• https://suse.com/support/update/announcement/2024/suse-su-20243911-1 · Note
• https://suse.com/security/cve/CVE-2024-8996 · Note