<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div><div>Date: 20. 9. 2023</div>Severity: High<br><div>Affected versions: All midPoint versions prior to 4.4.6, 4.7.2</div><div>Fixed in versions: 4.8 (unreleased), 4.7.2, 4.4.6, 4.6.2 (unreleased)</div><br><br><div>Description</div></div><div><br data-mce-bogus="1"></div><div><br><div>CSRF vulnerability exists if midPoint is configured to use remote authentication using SAML 2 or OIDC and user was authorized using these providers. Users authenticated using built-in login form are not affected.</div><br><div><br data-mce-bogus="1"></div><div>Severity and Impact</div></div><div><br><div>This is High Severity Issue</div><br><div>Normal built-in midPoint login is not affected, but it is possible to construct CSRF attack for logged-in user if remote authentication via SAML 2 or OIDC was used to log in.</div></div><div><br data-mce-bogus="1"></div><div><br><div>Mitigation</div><div><br data-mce-bogus="1"></div><div>Users of affected MidPoint versions are advised to upgrade their deployments to the latest maintenance release.<br>Users of midPoint 4.6 should use build from support branch. </div></div><div><br><div><br data-mce-bogus="1"></div><div>Discussion and Explanation</div><br><div>During remote authentication sequence token-based CSRF protection (provided by Spring Framework) needs to be disabled for session, but the issue was that it was not automatically re-enabled once authentication was completed. The fixed code contains improved conditions and token based CSRF is enforced once remote authentication is completed.</div><div><br data-mce-bogus="1"></div><div>This advisory is also available at <a href="https://docs.evolveum.com/midpoint/reference/security/advisories/020-csrf-not-working-when-using-saml2/">https://docs.evolveum.com/midpoint/reference/security/advisories/020-csrf-not-working-when-using-saml2/</a><br><br><pre style="color: #000000; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="color: #000000; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">--
Anton Tkáčik
Software Developer
evolveum.com</pre><br></div></div></div></body></html>