CVE-2025-46784
📋 TL;DR
A denial-of-service vulnerability in Entr'ouvert Lasso's SAML processing allows attackers to crash the service by sending specially crafted SAML responses. This affects systems using Lasso 2.5.1 for SAML authentication. The vulnerability can be exploited remotely without authentication.
💻 Affected Systems
- Entr'ouvert Lasso
📦 What is this software?
Lasso by Entrouvert
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of SAML authentication, preventing legitimate users from accessing protected resources.
Likely Case
Intermittent service disruptions affecting SAML authentication flows, potentially causing login failures.
If Mitigated
Minimal impact with proper network segmentation and monitoring to detect and block malicious SAML responses.
🎯 Exploit Status
Exploitation requires sending a malformed SAML response to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Monitor vendor channels for patches. 2. Consider upgrading to a newer version if available. 3. Apply workarounds in the meantime.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation to reject malformed SAML responses before they reach Lasso.
# Configure web application firewall rules to filter suspicious SAML responses
# Implement XML schema validation for incoming SAML messages
Rate Limiting
linuxLimit the rate of SAML response processing to prevent rapid exploitation attempts.
# Example using nginx: limit_req_zone $binary_remote_addr zone=saml:10m rate=10r/s;
# Add to location block: limit_req zone=saml burst=20 nodelay;
🧯 If You Can't Patch
- Implement network segmentation to isolate SAML endpoints from untrusted networks.
- Deploy intrusion detection systems to monitor for malformed SAML traffic patterns.
🔍 How to Verify
Check if Vulnerable:
Check if Lasso version 2.5.1 is installed and used for SAML processing.Check Version:
lasso-config --versionVerify Fix Applied:
Verify that workarounds are properly implemented and test with controlled malformed SAML responses.📡 Detection & Monitoring
Log Indicators:
- Unusual memory consumption spikes in Lasso processes
- Repeated authentication failures from SAML endpoints
- Process crashes or restarts of Lasso services
Network Indicators:
- Unusually large or malformed SAML responses
- High volume of SAML requests from single sources
SIEM Query:
source="lasso.log" AND ("memory" OR "crash" OR "error") AND "SAML"