Cloud Foundry UAA SAML 2.0 Signature Bypass Vulnerability

A vulnerability exists in Cloud Foundry UAA versions 77.30.0 prior to 78.7.0, as well as in CF Deployment versions 48.7.0 prior to 54.14.0. This vulnerability allows an attacker to bypass SAML 2.0 signature requirements, enabling them to obtain a token for any user and access UAA-protected systems. The issue arises because UAA accepts SAML 2.0 bearer assertions that are not signed or encrypted, but only when SAML 2.0 bearer assertions are enabled for a client.

Impact

Exploitation of this vulnerability allows for unauthorized access to UAA-protected systems by obtaining tokens for any user.

Remediation

Users are advised to upgrade to UAA version 78.9.0 or greater and to upgrade CF Deployment to version 55.0.0 or greater, which includes UAA version 78.10.0.