CVE-2020-26276
📋 TL;DR
This vulnerability allows attackers to modify trusted SAML responses in Fleet osquery manager, enabling unauthorized logins through SSO authentication. It affects Fleet users who have configured SSO login with SAML IdP. The issue stems from Go's standard library XML parsing flaws.
💻 Affected Systems
- Fleet osquery manager
📦 What is this software?
Fleet by Fleetdm
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to Fleet management console, potentially leading to compromise of all managed osquery endpoints.
Likely Case
Unauthorized users gaining access to Fleet dashboard with privileges matching the modified SAML response, enabling them to view/manage osquery data.
If Mitigated
No impact if SSO is disabled or patch is applied; authentication remains secure.
🎯 Exploit Status
Exploitation requires intercepting/modifying SAML responses, but the XML parsing vulnerability makes this straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.1
Vendor Advisory: https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx
Restart Required: Yes
Instructions:
1. Backup current Fleet configuration. 2. Stop Fleet service. 3. Upgrade to Fleet 3.5.1 or later. 4. Restart Fleet service. 5. Verify SSO authentication works correctly.
🔧 Temporary Workarounds
Disable SSO Authentication
allTemporarily disable SAML-based SSO authentication until patching is possible
Edit Fleet configuration to remove or comment out SSO settings
Restart Fleet service
🧯 If You Can't Patch
- Disable SSO authentication entirely in Fleet configuration
- Implement network segmentation to restrict access to Fleet instance
🔍 How to Verify
Check if Vulnerable:
Check Fleet version: if version < 3.5.1 AND SSO is configured, system is vulnerable.Check Version:
fleetctl version or check Fleet web interface version infoVerify Fix Applied:
Verify Fleet version is 3.5.1 or later and test SSO authentication with valid/invalid credentials.📡 Detection & Monitoring
Log Indicators:
- Failed SSO login attempts with modified XML
- Successful logins from unexpected users via SSO
- XML parsing errors in authentication logs
Network Indicators:
- Unusual SAML response modifications
- XML injection attempts in authentication traffic
SIEM Query:
source="fleet" AND (event="authentication_failure" OR event="sso_login") AND (message="*XML*" OR message="*SAML*")🔗 References
- https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020
- https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607
- https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx
- https://github.com/mattermost/xml-roundtrip-validator
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
- https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020
- https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607
- https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx
- https://github.com/mattermost/xml-roundtrip-validator
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
