CVE-2023-29129
📋 TL;DR
This vulnerability in Mendix SAML modules allows unauthenticated remote attackers to bypass authentication and gain unauthorized access to applications by exploiting insufficient verification of SAML assertions. It affects multiple Mendix versions across different compatibility tracks, specifically due to an incomplete fix for CVE-2023-25957 in non-default configurations. Organizations using the affected SAML modules are at risk of compromise.
💻 Affected Systems
- Mendix SAML (Mendix 7 compatible)
- Mendix SAML (Mendix 8 compatible)
- Mendix SAML (Mendix 9 latest compatible, New Track)
- Mendix SAML (Mendix 9 latest compatible, Upgrade Track)
- Mendix SAML (Mendix 9.12/9.18 compatible, New Track)
- Mendix SAML (Mendix 9.12/9.18 compatible, Upgrade Track)
- Mendix SAML (Mendix 9.6 compatible, New Track)
- Mendix SAML (Mendix 9.6 compatible, Upgrade Track)
📦 What is this software?
Saml by Mendix
Saml by Mendix
Saml by Mendix
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative access to the application, leading to data theft, system takeover, or further network compromise.
Likely Case
Unauthenticated attackers bypass login to access sensitive application data or functionality, potentially escalating privileges.
If Mitigated
With proper patching or workarounds, authentication remains intact, preventing unauthorized access and limiting impact to minor disruptions.
🎯 Exploit Status
Exploitation likely involves crafting malicious SAML assertions to bypass authentication, with low complexity due to the unauthenticated nature and insufficient verification.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Mendix SAML modules: Mendix 7 compatible: V1.18.0 or later; Mendix 8 compatible: V2.4.0 or later; Mendix 9 latest compatible, New Track: V3.6.1 or later; Mendix 9 latest compatible, Upgrade Track: V3.6.0 or later; Mendix 9.12/9.18 compatible, New Track: V3.3.15 or later; Mendix 9.12/9.18 compatible, Upgrade Track: V3.3.14 or later; Mendix 9.6 compatible, New Track: V3.2.7 or later; Mendix 9.6 compatible, Upgrade Track: V3.2.6 or later
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-851884.pdf
Restart Required: Yes
Instructions:
1. Identify the Mendix version and SAML module version in use. 2. Download and apply the patched version from the Mendix App Store or vendor sources. 3. Restart the Mendix application to apply changes. 4. Verify the fix by testing authentication functionality.
🔧 Temporary Workarounds
Disable SAML Authentication
allTemporarily disable SAML-based authentication and use alternative methods (e.g., local authentication) if possible to mitigate the risk.
Modify Mendix application configuration to remove or disable SAML module settings.
Network Segmentation
allRestrict access to affected applications using firewalls or network controls to limit exposure to trusted networks only.
Configure firewall rules to allow access only from specific IP ranges or VLANs.
🧯 If You Can't Patch
- Implement strict network access controls to limit application exposure to internal or trusted users only.
- Monitor authentication logs for unusual activity and set up alerts for failed or bypassed login attempts.
🔍 How to Verify
Check if Vulnerable:
Check the SAML module version in the Mendix application's configuration or via the Mendix Modeler under 'Project Settings' > 'App Store modules'.Check Version:
In Mendix, navigate to 'Project' > 'Show Project Directory in Explorer' and inspect module metadata files, or use the Mendix Modeler interface to view installed modules.Verify Fix Applied:
After updating, verify the SAML module version matches the patched version and test authentication with valid and invalid SAML assertions to ensure no bypass occurs.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts, SAML assertion failures, or successful logins from unexpected sources without proper credentials.
Network Indicators:
- Abnormal SAML traffic patterns, such as repeated authentication requests or malformed SAML messages.
SIEM Query:
Example: 'source="mendix_logs" AND (event_type="authentication_failure" OR event_type="saml_bypass")'