Loading vulnerability…
Apache CXF SecurityTokenService SAML Token Validation Bypass
CVE-2014-0034 is an authentication-bypass vulnerability in Apache CXF SecurityTokenService (STS). When STS caching is enabled during SAML-token validation, affected implementations can accept certain invalid SAML tokens as valid. The flaw affects Apache CXF 2.6.x before 2.6.12 and 2.7.x before 2.7.9.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can submit a specially crafted invalid SAML token and obtain unauthorized access to an application that relies on the vulnerable Apache CXF STS instance for SAML-token validation. The vulnerability compromises authentication and can expose application resources available to the improperly authenticated identity.
If you can’t patch tonight, do this now.
No vendor-specific workaround is documented. Pending upgrade, disable or avoid STS token caching where operationally feasible, restrict network access to SAML-validation endpoints, and ensure applications do not rely on affected STS instances for authentication decisions.
Patch, then assume compromise.
Upgrade Apache CXF to 2.6.12 or later on the 2.6 branch, or 2.7.9 or later on the 2.7 branch. Upgrading to 2.6.14 or later, or 2.7.11 or later, is recommended to incorporate additional security fixes. Apply the applicable vendor updates for bundled Apache CXF deployments, including affected JBoss products, and restart the application server after updating.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.