Full Report
The Mendix SAML module insufficiently protects from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version. Note: For compatibility reasons, fix versions are introduced in two release steps: The first fix versions address CVE-2022-37011. It removes the vulnerability, except when the not recommended, non default configuration option 'Allow Idp Initiated Authentication' is enabled. The second fix versions address CVE-2022-44457, which removes the issue for the non default configuration as well.
Analysis Summary
# Vulnerability: Mendix SAML Module Authentication Bypass via Replay Attack
## CVE Details
- **CVE ID:** CVE-2022-37011, CVE-2022-44457
- **CVSS Score:** 8.1 (High) *[Based on standard CVSS mapping for remote authentication bypass]*
- **CWE:** CWE-294: Authentication Bypass by Capture-replay
## Affected Systems
- **Products:** Mendix SAML Module
- **Versions:** All versions prior to the released fix versions (e.g., versions older than 3.3.9 / 2.3.0 depending on the Mendix version line).
- **Configurations:**
- **CVE-2022-37011:** Affects standard configurations.
- **CVE-2022-44457:** Specifically affects configurations where the non-default, non-recommended option **"Allow Idp Initiated Authentication"** is enabled.
## Vulnerability Description
The Mendix SAML module fails to sufficiently protect against packet capture replay attacks. In a standard SAML exchange, security tokens should be valid for a single use or a very short time window. Due to improper validation of these tokens, an attacker who intercepts a valid SAML response (packet capture) can re-submit the same token to the Mendix application to masquerade as the legitimate user.
## Exploitation
- **Status:** Not reported as exploited in the wild; PoC not publicly provided in the context.
- **Complexity:** Medium (Requires ability to intercept network traffic).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full access to user data within the application).
- **Integrity:** High (Ability to modify data as the impersonated user).
- **Availability:** Low (Does not inherently crash the system, but unauthorized access can lead to disruption).
## Remediation
### Patches
Mendix has released patches in two phases to address the specific configurations:
1. **Phase 1 (CVE-2022-37011):** Update to the latest module version available in the Mendix Marketplace. This secures standard configurations but leaves the "IdP Initiated" option vulnerable.
2. **Phase 2 (CVE-2022-44457):** Update to the subsequent fix release which specifically secures the "Allow Idp Initiated Authentication" configuration.
*Users are strongly advised to update to the absolute latest version of the SAML module available in the Mendix Marketplace to ensure both CVEs are addressed.*
### Workarounds
- Disable the non-default configuration **"Allow Idp Initiated Authentication"** if it is not business-critical.
- Ensure all SAML traffic is encrypted via TLS to prevent packet capture on the wire (though this does not mitigate capture at the endpoint).
## Detection
- **Indicators of compromise:** Monitor application logs for multiple successful logins using the same SAML assertion ID within a short timeframe.
- **Detection methods and tools:** Audit Mendix application logs for unexpected logins from IP addresses that do not match the original user session profile.
## References
- Mendix Security Advisories: hxxps[://]trust[.]mendix[.]com/
- Mendix Marketplace (SAML Module): hxxps[://]marketplace[.]mendix[.]com/link/component/1130
- NIST NVD CVE-2022-37011: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2022-37011
- NIST NVD CVE-2022-44457: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2022-44457