#############################################################
#
# COMPASS SECURITY ADVISORY
# http://www.csnc.ch/en/downloads/advisories.html
#
#############################################################
#
# Product:   nevisAuth [1]
# Vendor:    AdNovum [2]
# CVD ID:    CVE-2015-5372
# Subject:   Authentication Bypass
# Risk:      Critical
# Effect:    Remotely exploitable
# Authors:   Antoine Neuenschwander (antoine.neuenschwander@csnc.ch)
#            Roland Bischofberger (roland.bischofberger@csnc.ch)
# Date:      2015-09-21
#
#############################################################

Introduction:
-------------
nevisAuth implements strong user and system authentication for identity and
access management solutions. It offers secure execution of multi-step
authentication and is able to dynamically adjust authentication strengths.
nevisAuth is highly flexible, easily integrated and supports plug-ins to various
authentication methods. [1]

Security Analysts of Compass Security Schweiz AG [3] discovered a security flaw
in the SAML 2.0 implementation of nevisAuth, which allows an attacker to bypass
the signature validation of security assertions, and therefore impersonate other
users.


Affected:
---------
nevisAuth since v4.13.0.0 (2012-11-21)
A security fix was released with version v4.18.3.1 (2015-07-02)


Technical Description:
----------------------
When configured as a SAML 2.0 service provider (SP), nevisAuth authenticates
users based on security assertions issued and signed by a trusted identity
provider (IdP). An assertion contains various fields about the user or subject
being authenticated, e.g. a name identifier (NameID), various attributes and
timestamps. Trust is based on the IdP's certificate, which is used to validate
the digital signature of security assertions.

In a setup where security assertions are conveyed via User-Agent (i.e when using
HTTP POST Binding), it is possible to forge and inject new assertions based on
data intercepted during a valid past authentication process. To achieve this,
the signing certificate is extracted from the assertion and then cloned to
reflect all X.509 data fields. A new public/private key pair is generated. The
public key is inserted into the certificate and the private key is used to sign
it. The signing certificate in the security assertion is now replaced with its
rogue copy. The attacker can then modify arbitrary values of the assertion, for
example the NameID. Finally, the assertion is signed with the cloned
certificate.

Due to a flaw in affected versions of nevisAuth, it is possible to bypass
validation of security assertions by presenting the system with forged
assertions as described above. In consequence, an attacker can impersonate
other users. More details on the attack can be found in [4].


Workaround / Fix:
-----------------
AdNovum released a security fix in nevisAuth v4.18.3.1 (2015-07-02) to address
this issue.

Alternatively, when using HTTP POST Binding, use encrypted security assertions
for transmission via the User-Agent. Or completely avoid transmitting security
assertions over insecure channels by using HTTP Artifact Binding.


Timeline:
---------
2015-06-26:     Discovered vulnerability
2015-06-30:     CVE ID requested
2015-07-01:     Initial vendor notification
2015-07-02:     Vendor confirmed security issue
2015-07-03:     Vendor released security fix & guidance to its customers
2015-07-06:     CVE ID assigned
2015-09-21:     Public disclosure


Acknowledgements:
-----------------
This vulnerability was discovered using the SAMLRaider Plugin [5] for Burp
Suite [6], developed by Roland Bischofberger (roland.bischofberger@csnc.ch) and
Emanuel Duss (emanuel.duss@gmail.com).


References:
-----------
[1]: https://www.nevis.ch/en/products/nevisauth-authentication-service.html
[2]: http://www.adnovum.ch/en/
[3]: http://www.csnc.ch/advisories
[4]: http://blog.csnc.ch/2015/09/saml-sp-authentication-bypass-vulnerability-in-nevisauth
[5]: https://github.com/SAMLRaider/SAMLRaider
[6]: http://portswigger.net/burp/