CVE-2021-43999
📋 TL;DR
This vulnerability in Apache Guacamole allows attackers to impersonate other users when SAML authentication is enabled. It affects Apache Guacamole 1.2.0 and 1.3.0 installations with SAML support configured. Attackers can bypass authentication controls to gain unauthorized access to remote desktop sessions.
💻 Affected Systems
- Apache Guacamole
📦 What is this software?
Guacamole by Apache
Guacamole by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all Guacamole user accounts, allowing attackers to access sensitive systems and data through remote desktop sessions.
Likely Case
Unauthorized access to specific user accounts, potentially leading to data theft, lateral movement, or privilege escalation within connected systems.
If Mitigated
Limited impact with proper network segmentation and monitoring, but authentication bypass still possible for targeted accounts.
🎯 Exploit Status
Exploitation requires SAML authentication to be enabled and the attacker to have some access to manipulate SAML responses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.0
Vendor Advisory: https://lists.apache.org/thread/4dt9h5mo4o9rxlgxm3rp8wfqdtdjn2z9
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Upgrade to Apache Guacamole 1.4.0 or later. 3. Restart Guacamole services. 4. Verify SAML authentication is working correctly.
🔧 Temporary Workarounds
Disable SAML Authentication
allTemporarily disable SAML authentication until patching is possible
Edit guacamole.properties and remove or comment SAML configuration
Restart Guacamole services
🧯 If You Can't Patch
- Implement network segmentation to isolate Guacamole servers from critical systems
- Enable detailed logging and monitoring for SAML authentication events and user impersonation attempts
🔍 How to Verify
Check if Vulnerable:
Check Guacamole version and SAML configuration. If version is 1.2.0 or 1.3.0 and SAML is enabled, system is vulnerable.Check Version:
Check Guacamole web interface or server logs for version informationVerify Fix Applied:
Verify Guacamole version is 1.4.0 or later and test SAML authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual SAML response patterns
- Multiple authentication attempts from same IP with different user identities
- User sessions originating from unexpected locations
Network Indicators:
- Abnormal SAML traffic patterns
- Authentication requests with manipulated SAML assertions
SIEM Query:
source="guacamole" AND (event_type="authentication" OR event_type="saml") AND (status="failure" OR user_changed="true")