CVE-2024-8698

published 2024-09-19

CVE-2024-8698: A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is…

Priority P3 55 high 7.7 CVSS 3.1

AV N AC H PR L UI N S C C H I L A L

EXPLOIT

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.

Detection & IOCs extracted from sources · hover to see the quote

path /realms/master/broker/saml/endpoint↗

cookie AUTH_SESSION_ID_LEGACY↗

• → A successful exploit results in an HTTP 302 redirect response containing both KEYCLOAK_IDENTITY and KEYCLOAK_SESSION cookies in the response headers, indicating session establishment under a manipulated identity. ↗
• → The attack is delivered via a POST to the SAML broker endpoint with a crafted SAMLResponse parameter (base64+URL-encoded) and a RelayState, using a stolen AUTH_SESSION_ID_LEGACY cookie. Monitor for SAML broker endpoint POST requests where the SAMLResponse contains a modified Assertion ID (ID attribute truncated by one character) alongside a retained ds:Signature node. ↗
• → The exploit manipulates XML structure by moving the ds:Signature node from the Assertion to immediately after the saml:Issuer element at the Response level, then injecting a modified unsigned Assertion. Detect SAML responses where a ds:Signature appears as a sibling of saml:Issuer at the Response level while a separate Assertion lacks a signature. ↗
• → The core flaw is in Keycloak's XMLSignatureUtil class: signature scope is determined by XML position rather than the Reference element. Flag any SAML response where the ds:Signature/ds:SignedInfo/ds:Reference URI does not match the ID of the top-level element containing the signature. ↗

• · The Nuclei template requires a valid pre-authenticated SAMLResponse and its associated AUTH_SESSION_ID_LEGACY cookie and RelayState to be supplied as variables before execution — it does not generate these from scratch. ↗
• · The exploit script requires Python with the lxml library pre-installed on the system running Nuclei. ↗
• · Affected packages are org.keycloak/keycloak-saml-core-public in both Red Hat Build of Keycloak and Red Hat Single Sign-On 7. No mitigation meeting Red Hat's criteria is available; patching via the listed RHSAs is required. ↗

CVSS provenance

nvd v3.1 7.7 HIGH CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

vendor_redhat 7.7 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-347