CVE-2024-36383
📋 TL;DR
This vulnerability in Logpoint SAML Authentication allows attackers to delete arbitrary files by injecting crafted filenames into SAML SSO-URL responses. This can cause login outages for SAML authentication. Organizations using Logpoint SAML Authentication before version 6.0.3 are affected.
💻 Affected Systems
- Logpoint SAML Authentication
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Critical system files could be deleted, causing complete SAML authentication failure and preventing all user logins via SAML.
Likely Case
Attackers delete configuration or temporary files, causing intermittent login failures and service disruption.
If Mitigated
With proper input validation and file permission restrictions, impact is limited to non-critical files in isolated directories.
🎯 Exploit Status
Exploitation requires crafting malicious SAML responses but doesn't require authentication to the target system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.3
Vendor Advisory: https://servicedesk.logpoint.com/hc/en-us/articles/19128172110621-Arbitrary-file-deletion-through-URL-Injection-to-SAML-SSO-URL-Response
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Upgrade Logpoint SAML Authentication to version 6.0.3 or later. 3. Restart the SAML authentication service. 4. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable SAML Authentication
allTemporarily disable SAML authentication and use alternative authentication methods.
Network Access Restrictions
allRestrict access to SAML endpoints to trusted IP addresses only.
🧯 If You Can't Patch
- Implement strict input validation for SAML state parameters
- Apply file system permissions to restrict deletion of critical files
🔍 How to Verify
Check if Vulnerable:
Check Logpoint SAML Authentication version. If version is below 6.0.3, the system is vulnerable.Check Version:
Check Logpoint admin interface or consult Logpoint documentation for version checking.Verify Fix Applied:
Verify the version is 6.0.3 or higher and test SAML authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Unexpected file deletion events in system logs
- SAML authentication failures with unusual state parameters
Network Indicators:
- Unusual SAML response patterns with long or crafted state parameters
SIEM Query:
Search for file deletion events in system logs correlated with SAML authentication attempts containing unusual state parameter values.