what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

nevisAuth Authentication Bypass

nevisAuth Authentication Bypass
Posted Sep 21, 2015
Authored by Roland Bischofberger, Antoine Neuenschwander

nevisAuth versions since 4.13.0.0 (2012-11-21) and prior to 4.18.3.1 (2015-07-02) suffer from an authentication bypass vulnerability.

tags | advisory, bypass
advisories | CVE-2015-5372
SHA-256 | ad23e54747c35436add7b30033271b8704ead8a7da713d8ec53805179693f1de

nevisAuth Authentication Bypass

Change Mirror Download
#############################################################
#
# COMPASS SECURITY ADVISORY
# http://www.csnc.ch/en/downloads/advisories.html
#
#############################################################
#
# Product: nevisAuth [1]
# Vendor: AdNovum [2]
# CVD ID: CVE-2015-5372
# Subject: Authentication Bypass
# Risk: Critical
# Effect: Remotely exploitable
# Authors: Antoine Neuenschwander (antoine.neuenschwander@csnc.ch)
# Roland Bischofberger (roland.bischofberger@csnc.ch)
# Date: 2015-09-21
#
#############################################################

Introduction:
-------------
nevisAuth implements strong user and system authentication for identity and
access management solutions. It offers secure execution of multi-step
authentication and is able to dynamically adjust authentication strengths.
nevisAuth is highly flexible, easily integrated and supports plug-ins to various
authentication methods. [1]

Security Analysts of Compass Security Schweiz AG [3] discovered a security flaw
in the SAML 2.0 implementation of nevisAuth, which allows an attacker to bypass
the signature validation of security assertions, and therefore impersonate other
users.


Affected:
---------
nevisAuth since v4.13.0.0 (2012-11-21)
A security fix was released with version v4.18.3.1 (2015-07-02)


Technical Description:
----------------------
When configured as a SAML 2.0 service provider (SP), nevisAuth authenticates
users based on security assertions issued and signed by a trusted identity
provider (IdP). An assertion contains various fields about the user or subject
being authenticated, e.g. a name identifier (NameID), various attributes and
timestamps. Trust is based on the IdP's certificate, which is used to validate
the digital signature of security assertions.

In a setup where security assertions are conveyed via User-Agent (i.e when using
HTTP POST Binding), it is possible to forge and inject new assertions based on
data intercepted during a valid past authentication process. To achieve this,
the signing certificate is extracted from the assertion and then cloned to
reflect all X.509 data fields. A new public/private key pair is generated. The
public key is inserted into the certificate and the private key is used to sign
it. The signing certificate in the security assertion is now replaced with its
rogue copy. The attacker can then modify arbitrary values of the assertion, for
example the NameID. Finally, the assertion is signed with the cloned
certificate.

Due to a flaw in affected versions of nevisAuth, it is possible to bypass
validation of security assertions by presenting the system with forged
assertions as described above. In consequence, an attacker can impersonate
other users. More details on the attack can be found in [4].


Workaround / Fix:
-----------------
AdNovum released a security fix in nevisAuth v4.18.3.1 (2015-07-02) to address
this issue.

Alternatively, when using HTTP POST Binding, use encrypted security assertions
for transmission via the User-Agent. Or completely avoid transmitting security
assertions over insecure channels by using HTTP Artifact Binding.


Timeline:
---------
2015-06-26: Discovered vulnerability
2015-06-30: CVE ID requested
2015-07-01: Initial vendor notification
2015-07-02: Vendor confirmed security issue
2015-07-03: Vendor released security fix & guidance to its customers
2015-07-06: CVE ID assigned
2015-09-21: Public disclosure


Acknowledgements:
-----------------
This vulnerability was discovered using the SAMLRaider Plugin [5] for Burp
Suite [6], developed by Roland Bischofberger (roland.bischofberger@csnc.ch) and
Emanuel Duss (emanuel.duss@gmail.com).


References:
-----------
[1]: https://www.nevis.ch/en/products/nevisauth-authentication-service.html
[2]: http://www.adnovum.ch/en/
[3]: http://www.csnc.ch/advisories
[4]: http://blog.csnc.ch/2015/09/saml-sp-authentication-bypass-vulnerability-in-nevisauth
[5]: https://github.com/SAMLRaider/SAMLRaider
[6]: http://portswigger.net/burp/
Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    16 Files
  • 18
    Jun 18th
    26 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    18 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close