CVE-2022-35741
📋 TL;DR
Apache CloudStack versions 4.5.0 and later contain an XML external entity (XXE) injection vulnerability in the SAML 2.0 authentication plugin. This vulnerability could allow attackers to read arbitrary files, cause denial of service, or perform server-side request forgery attacks. Only systems with the SAML 2.0 plugin enabled are affected.
💻 Affected Systems
- Apache CloudStack
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the CloudStack management server through arbitrary file reading leading to credential theft, SSRF attacks against internal systems, and potential denial of service.
Likely Case
Unauthorized file system access to read sensitive configuration files, credentials, or other data from the CloudStack management server.
If Mitigated
No impact if SAML 2.0 plugin is disabled or proper XML parsing controls are implemented.
🎯 Exploit Status
Exploitation requires SAML 2.0 plugin to be enabled and attacker to interact with SAML authentication endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.16.1.0, 4.17.0.0, and later versions
Vendor Advisory: https://lists.apache.org/thread/hwhxvtwp1d5dsm156bsf1cnyvtmrfv3f
Restart Required: Yes
Instructions:
1. Upgrade to Apache CloudStack 4.16.1.0, 4.17.0.0, or later. 2. Restart CloudStack management server services. 3. Verify SAML 2.0 plugin functionality if required.
🔧 Temporary Workarounds
Disable SAML 2.0 Plugin
allDisable the vulnerable SAML 2.0 authentication plugin if not required
Edit CloudStack configuration to disable SAML 2.0 plugin
Implement XML Parsing Controls
allConfigure XML parsers to disable external entity processing
Set XML parser properties: setFeature("http://xml.org/sax/features/external-general-entities", false); setFeature("http://xml.org/sax/features/external-parameter-entities", false);
🧯 If You Can't Patch
- Disable SAML 2.0 authentication plugin immediately
- Implement network segmentation to restrict access to CloudStack management server SAML endpoints
🔍 How to Verify
Check if Vulnerable:
Check CloudStack version and SAML plugin status: 1. Verify CloudStack version >= 4.5.0. 2. Check if SAML 2.0 plugin is enabled in configuration.Check Version:
cloudstack-management --versionVerify Fix Applied:
Verify CloudStack version is >= 4.16.1.0 or >= 4.17.0.0 and test SAML authentication functionality if required.📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors in CloudStack logs
- Multiple failed SAML authentication attempts
- Unexpected file access patterns
Network Indicators:
- Unusual XML payloads in SAML authentication requests
- Requests to internal resources from CloudStack server
SIEM Query:
source="cloudstack" AND (message="*XXE*" OR message="*XML*" OR message="*SAML*")🔗 References
- http://www.openwall.com/lists/oss-security/2022/07/18/2
- http://www.openwall.com/lists/oss-security/2022/07/20/1
- https://lists.apache.org/thread/hwhxvtwp1d5dsm156bsf1cnyvtmrfv3f
- http://www.openwall.com/lists/oss-security/2022/07/18/2
- http://www.openwall.com/lists/oss-security/2022/07/20/1
- https://lists.apache.org/thread/hwhxvtwp1d5dsm156bsf1cnyvtmrfv3f
