CVE-2020-27846
published 2020-12-21CVE-2020-27846: A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.87%
91.1th percentile
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| crewjam | saml | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| github.com | crewjam_saml | >= 0 < 0.4.3 | 0.4.3 |
| grafana | grafana | < 6.7.5 | 6.7.5 |
| grafana | grafana | >= 7.0.0 < 7.2.3 | 7.2.3 |
| grafana | grafana | >= 7.3.0 < 7.3.6 | 7.3.6 |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_service_mesh | — | — |
| saml_project | saml | < 0.4.3 | 0.4.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is a SAML signature verification bypass in the crewjam/saml Go module; detect exploitation by monitoring for SAML authentication successes that lack a valid cryptographic signature, particularly where XML namespace prefix or attribute/directive round-trip instability may be exploited. ↗
- →Applications using Go's encoding/xml package for SAML or XML-DSig processing are at risk due to XML tokenization round-trip instability (attribute, directive, and element namespace prefix semantics); audit all SAML-processing code paths that rely on crewjam/saml for signature validation integrity. ↗
- →Workaround/detection aid: use Mattermost's xml-roundtrip-validator to validate XML round-trip stability before processing SAML assertions, which can help detect crafted malicious inputs exploiting this class of vulnerability. ↗
- ·Grafana deployments using oauth-proxy as an Auth Proxy do NOT use the vulnerable SAML authentication path in crewjam/saml and are not exploitable via this CVE. ↗
- ·SAML is only available in the Enterprise version of Grafana; non-Enterprise deployments packaging crewjam/saml are not exploitable even if the vulnerable code is present. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
crewjam/saml: authentication bypass in saml authentication
vendor_redhat·2020-12-17·CVSS 9.8
CVE-2020-27846 [CRITICAL] CWE-115 crewjam/saml: authentication bypass in saml authentication
crewjam/saml: authentication bypass in saml authentication
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Statement: Grafana in the OpenShift Container Platform (OCP) and OpenShift ServiceMesh) uses oauth-proxy as an Auth Proxy, and therefore does not make use of the vulnerable SAML Authentication in the github.com/crewjam/saml module used by Grafana. Additionally, SAML is only
Red Hat
go: encoding/xml: XML directives instability
vendor_redhat·2020-12-14·CVSS 9.8
CVE-2020-29510 [CRITICAL] CWE-115 go: encoding/xml: XML directives instability
go: encoding/xml: XML directives instability
The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
A flaw was found in go. Encoding and decoding of XML directives could lead to changes in the observed integrity. An attacker could use this flaw to trick applications which rely on directive integrity for security decisions to make those decisions incorrectly. Known vulnerability use-cases are SAML and XML-DSig.
Statement: All uses of xml/encoding package in OpenShift Container Platform, OpenShift Jaeger, OpenShift Service Mesh (OSSM), OpenShift Virtuali
Red Hat
go: encoding/xml: XML attribute instability
vendor_redhat·2020-12-14·CVSS 9.8
CVE-2020-29509 [CRITICAL] CWE-115 go: encoding/xml: XML attribute instability
go: encoding/xml: XML attribute instability
The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
A flaw was found in go. Encoding and decoding of XML attributes could lead to changes in the observed integrity. An attacker could use this flaw to trick applications which rely on attribute integrity for security decisions to make those decisions incorrectly. Known vulnerability use-cases are SAML and XML-DSig.
Statement: All uses of xml/encoding package in OpenShift Container Platform, OpenShift Jaeger, OpenShift Service Mesh (OSSM), OpenShift Vi
Red Hat
go: encoding/xml: XML element instability
vendor_redhat·2020-12-14·CVSS 9.8
CVE-2020-29511 [CRITICAL] CWE-115 go: encoding/xml: XML element instability
go: encoding/xml: XML element instability
The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
A flaw was found in go. Encoding and decoding of XML elements could lead to changes in the observed integrity. An attacker could use this flaw to trick applications which rely on element integrity for security decisions to make those decisions incorrectly. Known vulnerability use-cases are SAML and XML-DSig.
Statement: All uses of xml/encoding package in OpenShift Container Platform, OpenShift Jaeger, OpenShift Service Mesh (OSSM), OpenShift Virtualiza
OSV
XML Processing error in github.com/crewjam/saml
osv·2021-06-23
CVE-2020-27846 [CRITICAL] XML Processing error in github.com/crewjam/saml
XML Processing error in github.com/crewjam/saml
### Impact
There are three vulnerabilities in the go `encoding/xml` package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see [xml-roundtrip-validator](https://github.com/mattermost/xml-roundtrip-validator)
### Patches
In version 0.4.3, all XML input is validated prior to being parsed.
GHSA
XML Processing error in github.com/crewjam/saml
ghsa·2021-06-23
CVE-2020-27846 [CRITICAL] CWE-115 XML Processing error in github.com/crewjam/saml
XML Processing error in github.com/crewjam/saml
### Impact
There are three vulnerabilities in the go `encoding/xml` package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see [xml-roundtrip-validator](https://github.com/mattermost/xml-roundtrip-validator)
### Patches
In version 0.4.3, all XML input is validated prior to being parsed.
OSV
Signature validation bypass due to XML processing error in github.com/crewjam/saml
osv·2021-04-14
CVE-2020-27846 Signature validation bypass due to XML processing error in github.com/crewjam/saml
Signature validation bypass due to XML processing error in github.com/crewjam/saml
Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1907670https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/https://security.netapp.com/advisory/ntap-20210205-0002/https://bugzilla.redhat.com/show_bug.cgi?id=1907670https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YUTKIRWT6TWU7DS6GF3EOANVQBFQZYI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICP3YRY2VUCNCF2VFUSK77ZMRIC77FEM/https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/https://security.netapp.com/advisory/ntap-20210205-0002/
2020-12-21
Published