Vulnerability · Published Dec 17, 2020 · Assigned by GitHub_M
CVE-2020-26276SAML authentication vulnerability in Fleet
Critical 10.0
In plain English
A critical-severity authentication bypass by spoofing in fleet from fleetdm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/fleetdm/fleet/v4 | 3.5.1 | GHSA-w3wf-cfx3-6gcx |
Affected products (as reported)
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx x_refsource_CONFIRM
- https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607 x_refsource_MISC
- https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020 x_refsource_MISC
- https://github.com/mattermost/xml-roundtrip-validator x_refsource_MISC
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities x_refsource_MISC