CVE-2023-34923
📋 TL;DR
This vulnerability allows attackers with valid Identity Provider credentials to impersonate any TOPdesk user by manipulating SAML responses through XML Signature Wrapping. It affects organizations using TOPdesk's SAML-based Single Sign-on feature. Attackers can bypass authentication controls to gain unauthorized access to user accounts.
💻 Affected Systems
- TOPdesk
📦 What is this software?
Topdesk by Topdesk
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all TOPdesk user accounts, allowing attackers to access sensitive data, modify configurations, and perform administrative actions as any user.
Likely Case
Targeted account takeover where attackers impersonate specific users to access confidential information or perform unauthorized actions within the system.
If Mitigated
Limited impact if proper network segmentation, monitoring, and multi-factor authentication are implemented, though authentication bypass remains possible.
🎯 Exploit Status
Exploitation requires valid Identity Provider credentials and understanding of SAML/XML manipulation. Public technical details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v12.10.13 or later
Vendor Advisory: https://my.topdesk.com/tas/public/ssp/content/detail/knowledgeitem?unid=56a16ba1c2824e9a82655892ba75d3c0
Restart Required: Yes
Instructions:
1. Backup your TOPdesk instance. 2. Download and install TOPdesk v12.10.13 or later from the vendor portal. 3. Apply the update following vendor instructions. 4. Restart the TOPdesk service. 5. Verify SAML SSO functionality.
🔧 Temporary Workarounds
Disable SAML SSO
allTemporarily disable the SAML-based Single Sign-on feature until patching is complete
Navigate to TOPdesk administration panel > Authentication > SSO settings > Disable SAML
Implement SAML Response Validation
allAdd additional validation of SAML responses at the application level
Consult TOPdesk documentation for custom SAML validation configuration
🧯 If You Can't Patch
- Implement network segmentation to restrict access to TOPdesk SAML endpoints
- Enable detailed logging and monitoring of all authentication attempts and SAML responses
🔍 How to Verify
Check if Vulnerable:
Check if TOPdesk version is v12.10.12 or earlier and SAML SSO is enabled in administration settingsCheck Version:
Check TOPdesk version in administration panel or via 'Help > About' in the interfaceVerify Fix Applied:
Verify TOPdesk version is v12.10.13 or later and test SAML authentication functionality📡 Detection & Monitoring
Log Indicators:
- Multiple failed SAML authentication attempts followed by successful login from unusual locations
- SAML responses with unexpected XML structure or duplicate elements
- User logins from IP addresses not associated with their normal patterns
Network Indicators:
- Unusual SAML response sizes or structures in network traffic
- SAML assertions containing wrapped or duplicated signature elements
SIEM Query:
source="topdesk" AND (event_type="authentication" AND result="success") AND (saml_response_size > threshold OR user_agent="unusual")🔗 References
- https://char49.com/articles/topdesk-vulnerable-to-xml-signature-wrapping-attacks
- https://my.topdesk.com/tas/public/ssp/content/detail/knowledgeitem?unid=56a16ba1c2824e9a82655892ba75d3c0
- https://char49.com/articles/topdesk-vulnerable-to-xml-signature-wrapping-attacks
- https://my.topdesk.com/tas/public/ssp/content/detail/knowledgeitem?unid=56a16ba1c2824e9a82655892ba75d3c0
