CVE-2024-1735: Critical severity linecorp armeria vulnerability
Impact
The SAML implementation provided by armeria-saml currently accepts unsigned SAML messages (assertions, logout requests, etc.) as they are, rather than rejecting them by default. As a result, an attacker can forge a SAML message to authenticate themselves, despite the fact that such an unsigned SAML message should be rejected.
Patches
The vulnerability has been patched in Armeria version 1.27.2. All users who rely on armeria-saml older than version 1.27.2 must upgrade to 1.27.2 or later.
Workarounds
There is no known workaround for this vulnerability.
References
SamlMessageUtil.validateSignature()
Other sources
A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication. All users who rely on armeria-saml older than version 1.27.2 must upgrade to 1.27.2 or later.
— NVD
The in-app browser of LINE iOS versions below 14.9.0 contains a Universal XSS (UXSS) vulnerability. This vulnerability allows for cross-site scripting (XSS) where arbitrary JavaScript can be executed in the top frame from an embedded iframe on any displayed web site within the in-app browser. The in-app browser is usually opened by tapping on URLs contained in chat messages, and for the attack to be successful, the victim must trigger a click event on a malicious iframe. If an iframe embedded in any website can be controlled by an attacker, this vulnerability could be exploited to capture or alter content displayed in the top frame, as well as user session information. This vulnerability affects LINE iOS versions below 14.9.0 and does not affect other LINE clients such as LINE Android. Please update LINE iOS to version 14.9.0 or higher.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.linecorp.armeria:armeria-samlto a version that resolves this vulnerability.Fixed in 1.27.2 - Upgrade
Upgrade
armeria-samlto a version that resolves this vulnerability.Fixed in 1.27.2 - Configuration
The Saml implementation in armeria-saml accepts unsigned SAML messages by default; update behavior to reject unsigned SAML messages (assertions, logout requests, etc.) rather than accepting them as-is.
armeria-saml Unsigned SAML message handling = Reject by default
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1735?
CVE-2024-1735 has a high severity due to the risk of authentication bypass via unsigned SAML messages.
How do I fix CVE-2024-1735?
To fix CVE-2024-1735, upgrade the armeria-saml package to version 1.27.2 or later.
What software is affected by CVE-2024-1735?
CVE-2024-1735 affects versions of the armeria-saml package up to and including 1.27.1.
What type of vulnerability is CVE-2024-1735?
CVE-2024-1735 is an authentication vulnerability related to the acceptance of unsigned SAML messages.
Can CVE-2024-1735 lead to data breaches?
Yes, CVE-2024-1735 can lead to unauthorized access, potentially resulting in data breaches.