Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-1735

CVE-2024-1735:
Armeria SAML authentication bypass due to missing validation on unsigned SAML messages

9.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-1735
GHSA ID
GHSA-4m6j-23p2-8c54
EPSS Score
0.24948%
CWE
CWE-304
Published
2/26/2024
Updated
2/26/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.linecorp.armeria:armeria-samlmaven<= 1.27.11.27.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from missing enforcement of signature requirements in SAML message validation. The key vulnerable functions were the validateSignature implementations that: 1) In SamlMessageUtil, returned early for unsigned objects without checking a signatureRequired flag 2) In HttpRedirectBindingUtil, didn't validate() presence of signature parameters before attempting validation. The patch added signatureRequired checks in both locations and modified call sites to pass this configuration. The pre-patch behavior is clearly shown in the diff where these functions lacked signature presence checks and early rejection logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** S*ML impl*m*nt*tion provi*** *y `*rm*ri*-s*ml` *urr*ntly ****pts unsi*n** S*ML m*ss***s (*ss*rtions, lo*out r*qu*sts, *t*.) *s t**y *r*, r*t**r t**n r*j**tin* t**m *y ****ult. *s * r*sult, *n *tt**k*r **n *or** * S*ML m*ss*** to *ut**

Reasoning

T** vuln*r**ility st*mm** *rom missin* *n*or**m*nt o* si*n*tur* r*quir*m*nts in S*ML m*ss*** v*li**tion. T** k*y vuln*r**l* *un*tions w*r* t** `v*li**t*Si*n*tur*` impl*m*nt*tions t**t: *) In `S*mlM*ss***Util`, r*turn** **rly *or unsi*n** o*j**ts wit*