CVE-2024-41107

published 2024-07-19

CVE-2024-41107: The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an…

Priority P2 73 high 8.1 CVSS 3.1

AV N AC H PR N UI N S U C H I H A H

EXPLOIT

The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response with no signature and known or guessed username and other user details of a SAML-enabled CloudStack user-account. In such environments, this can result in a complete compromise of the resources owned and/or accessible by a SAML enabled user-account.

Affected users are recommended to disable the SAML authentication plugin by setting the "saml2.enabled" global setting to "false", or upgrade to version 4.18.2.2, 4.19.1.0 or later, which addresses this issue.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
apache	cloudstack	>= 4.19.0.0 < 4.19.1.0	4.19.1.0
apache	cloudstack	>= 4.5.0 < 4.18.2.2	4.18.2.2
apache_software_foundation	apache_cloudstack	4.19.0.0 – 4.19.0.2	—
apache_software_foundation	apache_cloudstack	4.5.0 – 4.18.2.1	—

Detection & IOCs extracted from sources · hover to see the quote

url /client/api?command=samlSso↗

command command=samlSsoLogin

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache CloudStack SAML Authentication Bypass (CVE-2024-41107)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/client/api"; http.request_body; content:"command|3d|samlSsoLogin"; fast_pattern; content:"SAMLResponse|3d|"; reference:url,github.com/d0rb/CVE-2024-41107/; reference:cve,2024-41107; classtype:web-application-activity; sid:2056320; rev:1; metadata:affected_product Apache_CloudStack, created_at 2024_09_30, cve CVE_2024_41107, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_09_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Exploit POST request targets /client/api?command=samlSso with a base64+URL-encoded SAMLResponse body containing no XML signature element and a known/guessed username.
• → Successful exploitation results in a 302 redirect response whose headers contain a 'sessionkey' cookie/field and Content-Type of text/xml — use these as match conditions.
• → The spoofed SAML response omits any XML Signature block; detection should flag SAMLResponse POST bodies that lack a <ds:Signature> or <Signature> element. ↗
• → FOFA fingerprint 'app="APACHE-CloudStack"' can be used to identify exposed CloudStack instances for proactive scanning.
• → Snort/Suricata SID 2056320 (ET rule) covers this CVE; deploy with SSLDecrypt for encrypted traffic visibility.

• · SAML authentication is disabled by default in CloudStack; this vulnerability only affects deployments where it has been explicitly enabled. ↗
• · Immediate mitigation is to set the 'saml2.enabled' global setting to 'false' if upgrading is not immediately possible. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-290