Bug 1216309

Summary:	VUL-0: CVE-2023-45683: grafana: github.com/crewjam/saml: XSS via missing Binding syntax validation
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	bfilho, gabriele.sonnu, gianluca.gabrielli, marina.latini, witold.bedyk
Version:	unspecified	Flags:	gianluca.gabrielli: needinfo? (bfilho)
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/382019/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-45683:7.1:(AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:
Bug Blocks:	1216308

Description SMASH SMASH 2023-10-17 08:02:24 UTC

Impact

The package does not validate the ACS Location URI according to the SAML binding being parsed.

If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow.

Consequently, an attacker may perform any authenticated action as the victim once the victim’s browser loaded the SAML IdP initiated SSO link for the malicious service provider.

Note: The severity is considered “High” because the SP registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or publicly accessible to ease the IdP interoperability.

Patches

This issue is fixed in 0.4.14

Workarounds

Users of the package can perform external validation of URLs provided in SAML metadata, or restrict the ability for end-users to upload arbitrary metadata.

References:
https://github.com/crewjam/saml/security/advisories/GHSA-267v-3v32-g6q5
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45683

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45683

Comment 1 Gabriele Sonnu 2023-10-17 08:14:59 UTC

Vulnerable versions of crewjam/saml are embedded in:

- SUSE:SLE-12-SP3:Update:Products:Cloud8:Update/grafana
- SUSE:SLE-12-SP4:Update:Products:Cloud9:Update/grafana
- SUSE:SLE-12:Update/grafana
- SUSE:SLE-15:Update/grafana
- SUSE:SLE-15-SP2:Update/grafana
- openSUSE:Factory/grafana

and also SUMA codestreams:

- SUSE:SLE-12:Update:Products:ManagerToolsBeta:Update/grafana
- SUSE:SLE-15:Update:Products:ManagerToolsBeta:Update/grafana

Comment 2 Marina Latini 2023-10-17 15:20:26 UTC

(In reply to Gabriele Sonnu from comment #1)
> Vulnerable versions of crewjam/saml are embedded in:
> 
> - SUSE:SLE-12-SP3:Update:Products:Cloud8:Update/grafana
> - SUSE:SLE-12-SP4:Update:Products:Cloud9:Update/grafana
> - SUSE:SLE-12:Update/grafana
> - SUSE:SLE-15:Update/grafana
> - SUSE:SLE-15-SP2:Update/grafana
> - openSUSE:Factory/grafana
> 
> and also SUMA codestreams:
> 
> - SUSE:SLE-12:Update:Products:ManagerToolsBeta:Update/grafana
> - SUSE:SLE-15:Update:Products:ManagerToolsBeta:Update/grafana

As already mentioned, please ignore the Beta codestreams. Those are used only while developing the new SUMA version.

Comment 5 Witek Bedyk 2023-10-23 13:08:41 UTC

Submitted PR to Grafana fork of the affected package:

https://github.com/grafana/saml/pull/34

According to private communication Grafana "team came to the conclusion that the security vulnerability is not exploitable for our [Grafana] usage of SAMLs crewjam."

The same should get confirmed by the developers on the PR soon.

Comment 6 Witek Bedyk 2023-11-17 15:23:12 UTC

Checked it once again.
SAML authentication is provided in Grafana Enterprise only.

https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/saml/

Our products are not affected.

Comment 7 Gabriele Sonnu 2024-01-24 16:36:55 UTC

Closing