CAS: Insufficiently Protected Credentials
CVE-2023-28857 is a high-severity insufficiently protected credentials vulnerability in CAS from Apereo, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected CAS versions: >= 6.5.0, < 6.5.9.1; >= 6.6.0, < 6.6.6. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.5% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Central Authentication Service to 6.5.9.1 or 6.6.6, whichever matches your release line, or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Apereo | CAS | >= 6.5.0, < 6.5.9.1; >= 6.6.0, < 6.6.6 | Not stated |
| Apereo | Central Authentication Service | 6.5.0 up to, but not including, 6.5.9.1; 6.6.0 up to, but not including, 6.6.6 | 6.5.9.1, 6.6.6 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 4.0 | Medium | CNA (github.com) |
| CVSS 3.1 | 7.5 | High | NVD |
Official description
Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certificates. These certificates can be provided via TLS handshake or a special HTTP header, such as “ssl_client_cert”. When checking the validity of the provided client certificate, X509CredentialsAuthenticationHandler performs check that this certificate is not revoked. To do so, it fetches URLs provided in the “CRL Distribution Points” extension of the certificate, which are taken from the certificate itself and therefore can be controlled by a malicious user. If the CAS server is configured to use an LDAP server for x509 authentication with a password, for example by setting a “cas.authn.x509.ldap.ldap-url” and “cas.authn.x509.ldap.bind-credential” properties, X509CredentialsAuthenticationHandler fetches revocation URLs from the certificate, which can be LDAP urls. When making requests to this LDAP urls, Apereo CAS uses the same password as for initially configured LDAP server, which can lead to a password leak. An unauthenticated user can leak the password used to LDAP connection configured on server. This issue has been addressed in version 6.6.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How developers prevent this class of flaw
- Use an appropriate security mechanism to protect the credentials.
- Make appropriate use of cryptography to protect the credentials.
- Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
More Insufficiently Protected Credentials vulnerabilities (CWE-522)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: poc, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- github.com/apereo/cas/releases/tag/v6.6.6Release Notes
Third-party and government advisories
- apereo.github.io/2023/02/20/x509-vuln/Third Party Advisory
- securitylab.github.com/advisories/GHSL-2023-009_Apereo_CAS/Third Party Advisory
Other vulnerabilities in CAS
- 9.1 Critical severity
- 7.5 High severity
- 7.5 High severity
- 9.8 Critical severity
- 8.1 High severity
Recent Insufficiently Protected Credentials vulnerabilities
- 7.3 High severity
- 9.8 Critical severity
- 7.5 High severity
- 8.8 High severity
- 7.5 High severity
- 7.5 High severity
Spotted an error? Tell us.