Skip to main content

Improper Verification of Cryptographic Signature

CVE-2024-47832

High
9.8/10

Summary

The ssoready is a single sign on provider implemented via docker. The package github.com/ssoready/ssoready versions prior to 0.0.0-20241009153838-7f92a0630439 are vulnerable to XML signature bypass attacks. An attacker can carry out a signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade. Do so by updating your SSOReady Docker images from "sha-..." to "sha-7f92a06". There are no known workarounds for this vulnerability.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-347 - Improper Verification of Cryptographic Signature

A cryptographic protocol is meant to ensure that services are provided in a secure manner. An application with absent or improper verification of cryptographic signatures allows malicious users to feed false messages to valid users or to disclose sensitive data, subverting the goals of the protocol. This can lead to security failures such as false authentication, account hijacking, and privilege escalation.

References

Advisory Timeline

  • Published