<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Date: 9 July 2019<br>
Severity: Medium (CVSS 4.9)<br>
Affected versions: all released midPoint versions<br>
Fixed in versions: 4.0 (unreleased), 3.9.1 (unreleased), 3.8.1
(unreleased), 3.7.3 (unreleased), 3.6.2 (unreleased)<br>
<br>
Description<br>
<br>
SOAP-based web service interface of midPoint does not limit
authentication attempts.<br>
<br>
Severity and Impact<br>
<br>
An attacker with access to midPoint SOAP web service can issue
numerous operation requests without any limitation of wrong
authentication attempts. This can be used by an attacker for brute
force attacks on user passwords.<br>
<br>
Mitigation<br>
<br>
Users of affected MidPoint versions are advised to upgrade their
deployments to the latest builds from the support branches.<br>
As this is a medium severity issue, it is not forcing official
maintenance releases of midPoint. However, the fix is provided in
all the support branches.<br>
<br>
Discussion and Explanation<br>
<br>
<p>MidPoint is using custom authentication module for SOAP web
services. Although authentication attempts were properly limited
in midPoint user interface and REST service, such limitation was
not applied to SOAP web service.</p>
<p>As SOAP web service is usually not accessible to public use,
impact of this security vulnerability is limited. Even though the
SOAP interface is becoming obsolete and it is going to be
deprecated in midPoint 4.0, this security vulnerability was fixed
in all supported versions of midPoint.</p>
<p>RESTful interface is not affected by this vulnerability.</p>
<br>
Credit<br>
<br>
This issue was reported by tester known as <span
class="mini-profile__name spec-mini-profile-name">nistr</span> by
the means of EU-Free and Open Source Software Auditing (EU-FOSSA2)
project.<br>
<br>
See Also<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.evolveum.com/display/midPoint/Security+Advisory%3A+SOAP+Web+Service+Vulnerable+To+Brute+Force+Attack">https://wiki.evolveum.com/display/midPoint/Security+Advisory%3A+SOAP+Web+Service+Vulnerable+To+Brute+Force+Attack</a><br>
<br>
<pre class="moz-signature">--
Radovan Semancik
Software Architect
evolveum.com
</pre>
</body>
</html>