A critical security flaw in Sitevision CMS versions 10.3.1 and older has exposed SAML authentication signing keys, enabling potential authentication bypass and session hijacking. In non-default configurations, the /webdav/files/ directory became accessible, exposing a saml-keystore file containing cryptographic keys for SAML Authn request signing. Sitevision, a widely adopted content management system in Sweden’s public sector and enterprise environments, relies on SAML for secure authentication flows. Once decrypted, the oiosaml private key allows signing malicious SAML Authn requests. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The vulnerability, tracked as CVE-2022-35202, stems from weak auto-generated passwords protecting Java keystores, which could be extracted and brute-forced to compromise private keys. The compromised private key enables attackers to forge SAML Authn requests with malicious AssertionConsumerServiceURL values. While SAML 2.0 requires Identity Providers (IdPs) to validate this URL against pre-registered SP metadata, some IdPs prioritize signed requests over metadata checks. Organizations using SAML must ensure IdPs validate AssertionConsumerServiceURL against metadata, irrespective of request signatures. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Analysts at ShellTrail identified that the adversaries could retrieve the keystore’s SHA1 password hash using tools like JksPrivkPrepare.jar, then crack it via GPU-accelerated tools like Hashcat. Sitevision patched the vulnerability in version 10.3.2 by enforcing stronger passwords, though existing installations require manual rotation. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Output reveals the oiosaml PrivateKeyEntry, confirming the key’s role in SAML signing.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 21 Feb 2025 19:30:20 +0000