PT-2024-5029 · Apache · Apache Cloudstack

Adam Pond + 3 · Published 2024-07-19 · Updated 2025-02-21 · CVE-2024-41107

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.5.0 through 4.18.2.1 Apache CloudStack versions 4.19.0.0 through 4.19.0.2

Description: The issue is related to the SAML authentication mechanism in Apache CloudStack, which does not enforce signature checks when SAML authentication is enabled. This allows an attacker to bypass authentication by submitting a spoofed SAML response with no signature and known or guessed username and other user details of a SAML-enabled CloudStack user-account. This can result in a complete compromise of the resources owned and/or accessible by a SAML-enabled user-account.

Recommendations: For Apache CloudStack versions 4.5.0 through 4.18.2.1, upgrade to version 4.18.2.2 or later. For Apache CloudStack versions 4.19.0.0 through 4.19.0.2, upgrade to version 4.19.1.0 or later. As a temporary workaround, consider disabling the SAML authentication plugin by setting the saml2.enabled global setting to false.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2024-05553

CVE-2024-41107

Affected Products

Apache Cloudstack

References · 19

• 🔥 https://github.com/d0rb/CVE-2024-41107 · Exploit
• https://cloudstack.apache.org/blog/security-release-advisory-cve-2024-41107 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41107 · Security Note
• https://lists.apache.org/thread/5q06g8zvmhcw6w3tjr6r5prqdw6zckg3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05553 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41107 · Vendor Advisory
• https://github.com/apache/cloudstack/issues/4519 · Note
• https://shapeblue.com/shapeblue-security-advisory-apache-cloudstack-cve-2024-41107 · Note
• http://openwall.com/lists/oss-security/2024/07/19/2 · Note
• https://t.me/proxy_bar/2176 · Telegram Post
• https://t.me/cvenotify/86717 · Telegram Post
• https://twitter.com/Komodosec/status/1828251133586088004 · Twitter Post
• https://avd.aquasec.com/nvd/2024/cve-2024-41107 · Note
• https://t.me/cvedetector/1213 · Telegram Post
• https://t.me/cvenotify/93960 · Telegram Post