CVE-2025-46404
📋 TL;DR
A denial of service vulnerability in Entr'ouvert Lasso's SAML signature verification allows attackers to crash the service by sending specially crafted SAML responses. This affects systems using Lasso 2.5.1 for SAML authentication. Organizations using Lasso for identity management or single sign-on are vulnerable.
💻 Affected Systems
- Entr'ouvert Lasso
📦 What is this software?
Lasso by Entrouvert
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of applications relying on Lasso for authentication, preventing legitimate users from accessing systems.
Likely Case
Intermittent service disruptions affecting authentication flows, potentially causing login failures for users.
If Mitigated
Minimal impact with proper monitoring and rapid incident response to restart affected services.
🎯 Exploit Status
Attack requires sending malformed SAML responses to vulnerable endpoints, which is straightforward for attackers familiar with SAML.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Monitor Lasso project for security updates. 2. Apply patch when available. 3. Restart affected services after patching.
🔧 Temporary Workarounds
Input validation filter
allImplement pre-processing to validate SAML response structure before passing to lasso_provider_verify_saml_signature
# Custom implementation required based on deployment
Rate limiting
allLimit requests to SAML endpoints to reduce impact of repeated exploitation attempts
# Configure web server or application rate limiting
🧯 If You Can't Patch
- Implement monitoring and alerting for service crashes related to SAML processing
- Deploy redundant authentication services with automatic failover
🔍 How to Verify
Check if Vulnerable:
Check if running Lasso 2.5.1 and using SAML authentication with signature verificationCheck Version:
lasso-config --versionVerify Fix Applied:
Verify updated version after patch becomes available📡 Detection & Monitoring
Log Indicators:
- Unexpected service crashes
- SAML processing errors
- Segmentation faults in Lasso processes
Network Indicators:
- Unusual volume of malformed SAML responses
- SAML responses with abnormal structure
SIEM Query:
source="*lasso*" AND (error OR crash OR segfault) AND saml