CVE-2022-23610
📋 TL;DR
This vulnerability allows attackers to bypass SAML SSO authentication in wire-server and impersonate any user with SAML credentials. It affects all wire-server instances prior to the 2022-01-27 release, enabling unauthorized access and potentially account creation in teams with SAML SSO enabled.
💻 Affected Systems
- wire-server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of SAML-authenticated accounts, unauthorized access to sensitive communications, and creation of new malicious accounts in affected teams.
Likely Case
Targeted impersonation of specific users by attackers who can obtain the required SSO login code, EntityID, and NameID information.
If Mitigated
No impact if wire-server is updated to the patched version or if SAML SSO is disabled entirely.
🎯 Exploit Status
Exploitation requires specific knowledge (SSO login code, EntityID, NameID) and ability to craft DSA signatures. The vulnerability is in an upstream SAML library.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2022-01-27
Vendor Advisory: https://github.com/wireapp/wire-server/security/advisories/GHSA-9jg9-9g37-4424
Restart Required: Yes
Instructions:
1. Update wire-server to version 2022-01-27 or later. 2. Restart the wire-server service. 3. Verify the update was successful.
🧯 If You Can't Patch
- Disable SAML SSO authentication entirely
- Enable SCIM provisioning if available to prevent new account creation
🔍 How to Verify
Check if Vulnerable:
Check wire-server version - if earlier than 2022-01-27 and SAML SSO is enabled, the system is vulnerable.Check Version:
Check wire-server deployment configuration or container tags for version information.Verify Fix Applied:
Confirm wire-server version is 2022-01-27 or later and test SAML authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual SAML authentication patterns
- Multiple failed SAML attempts followed by successful logins from unexpected sources
- New user creation via SAML when SCIM is disabled
Network Indicators:
- SAML authentication requests with unusual signatures or public keys
- Authentication from unexpected IP addresses
SIEM Query:
sourcetype=wire-server (saml_auth OR user_creation) | search status=success AND (unusual_ip OR multiple_attempts)