CVE-2024-5249
📋 TL;DR
This vulnerability allows attackers to replay SAML tokens in Akana API Platform, potentially enabling unauthorized access to protected resources. Organizations using Akana API Platform versions before 2024.1.0 are affected. The issue stems from insufficient validation of token uniqueness.
💻 Affected Systems
- Akana API Platform
📦 What is this software?
Akana Api by Perforce
⚠️ Risk & Real-World Impact
Worst Case
Attackers could gain unauthorized administrative access, compromise sensitive API data, or perform actions as legitimate users.
Likely Case
Attackers could gain unauthorized access to user accounts or protected API endpoints by reusing captured SAML tokens.
If Mitigated
With proper monitoring and short token lifetimes, impact would be limited to brief unauthorized access windows.
🎯 Exploit Status
Exploitation requires capturing valid SAML tokens, which typically requires some level of network access or position.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.1.0
Vendor Advisory: https://portal.perforce.com/s/detail/a91PA000001SUH7YAO
Restart Required: Yes
Instructions:
1. Download Akana API Platform 2024.1.0 or later. 2. Backup current configuration and data. 3. Install the updated version following vendor documentation. 4. Restart all Akana services.
🔧 Temporary Workarounds
Reduce SAML Token Lifetime
allConfigure shorter SAML token validity periods to limit replay window
Configure in Akana admin console: Security > SAML > Token Settings
Enable Token Replay Detection
allConfigure additional logging and monitoring for token reuse attempts
Enable audit logging for SAML token validation events
🧯 If You Can't Patch
- Implement network segmentation to limit access to SAML endpoints
- Deploy WAF rules to detect and block suspicious token reuse patterns
🔍 How to Verify
Check if Vulnerable:
Check Akana version via admin console or command: java -jar akana-admin.jar versionCheck Version:
java -jar akana-admin.jar versionVerify Fix Applied:
Verify version is 2024.1.0 or later and test SAML authentication with token replay attempts📡 Detection & Monitoring
Log Indicators:
- Multiple authentication attempts with same SAML token ID
- SAML token validation failures with duplicate IDs
Network Indicators:
- Repeated SAML assertions from same source
- Unusual timing patterns in SAML requests
SIEM Query:
source="akana" AND ("SAML token replay" OR "duplicate token" OR "token validation failed")