Paper/Archive/CVE-2024-47832

CVE-2024-47832

ssoready ssoready — XML Signature Bypass via differential XML parsing in ssoready

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 34.4.344 × 206.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.

Affected

ProductAffectedFixed inSource

ssoready< 0.0.0-20241009153838-7f92a0630439–CNA

ssoready< 7f92a067f92a06CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/ssoready/ssoready/security/advisories/GHSA-j2hr-q93x-gxvh refgithub.com/ssoready/ssoready/commit/7f92a0630439972fcbefa8c7eafe8c144bd89915 refssoready.com/docs/self-hosting/self-hosting-sso-ready