Loading vulnerability…
Apache WSS4J SAML SubjectConfirmation Spoofing
CVE-2014-3623 is an improper authentication vulnerability in Apache WSS4J when used by Apache CXF with the TransportBinding configuration. Apache WSS4J versions before 1.6.17 and 2.x versions before 2.0.2 do not, by default, fully enforce the security semantics required for SAML SubjectConfirmation methods. Apache CXF security components are affected in the 2.7.x line before 2.7.13 and the 3.0.x line before 3.0.2. The deficient verification can cause a SAML-authenticated WS-Security endpoint to accept assertions or confirmation methods without all required security properties being enforced.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can conduct identity or authentication spoofing against affected WSS4J-secured web-service endpoints that rely on SAML authentication. Successful exploitation may allow the attacker to impersonate an authenticated identity or obtain privileges associated with that identity, enabling unauthorized requests and potentially unauthorized modification of application data or execution of actions exposed to the impersonated principal.
If you can’t patch tonight, do this now.
If an upgrade cannot be applied immediately, avoid or disable TransportBinding for SAML-authenticated services where operationally feasible. Restrict network access to affected SOAP and WS-Security endpoints to trusted clients and networks, and limit the privileges granted to identities accepted through SAML authentication. Monitor authentication and authorization events for anomalous use of SAML identities.
Patch, then assume compromise.
Upgrade Apache WSS4J to version 1.6.17 or later for the 1.6.x line, or version 2.0.2 or later for the 2.x line. Upgrade Apache CXF cxf-rt-security and cxf-rt-ws-security to version 2.7.13 or later for the 2.7.x line, or 3.0.2 or later for the 3.0.x line. Apply the vendor-provided security update for affected bundled enterprise products, and restart the application server or affected service after updating where required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.