Tracecatに認証回避の脆弱性、1.0.0-beta.49で修正
Summary
Docker ComposeでSAMLログインを有効にしたTracecatは、署名のない偽の応答でも通してしまい、既存ユーザーのセッションを奪われるおそれがあります。該当する構成か確認し、署名の要求を明示的に有効にしたうえで修正版へ更新してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Docker ComposeでSAMLログインを有効にしたTracecatは、署名のない偽の応答でも通してしまい、既存ユーザーのセッションを奪われるおそれがあります。該当する構成か確認し、署名の要求を明示的に有効にしたうえで修正版へ更新してください。
Original description The description as published by the source.
Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled can render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty values, overriding secure application defaults and disabling both signature requirements. An unauthenticated attacker who can reach the SAML assertion consumer endpoint can submit a forged unsigned response for an existing Tracecat user email address and obtain that user’s session. Targeting an existing superadmin can result in superadmin account takeover. Exploitation does not create users when SAML user creation is disabled and does not affect default Fargate or Helm deployments. Version 1.0.0-beta.49 removes the insecure deployment pass-through and requires signed assertions and responses.
Source: CVE.org (CVE Program・cvelistV5) NVD
References
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com