CVE-2024-36383

Executive Summary

CVE-2024-36383 is a vulnerability in Logpoint SAML Authentication prior to version 6.0.3. An attacker can craft a malicious filename in the state field of a SAML SSO-URL response. When processed, the Logpoint system will delete the file corresponding to that filename. This can lead to a denial-of-service condition specifically targeting the SAML authentication login functionality, potentially causing a complete login outage for legitimate users.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary component of the Logpoint SIEM platform.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that a full CVSS vector has not been officially assigned by NVD at this time. However, based on the description, the vulnerability can be characterized as:

• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High

Threat Level: High. The vulnerability can cause a complete denial of service for SAML-based authentication, effectively locking users out of the Logpoint system.

Deep Dive & Mechanics

The vulnerability resides in how Logpoint SAML Authentication processes the state parameter in a SAML SSO-URL response. The state parameter is typically used to maintain client state across the redirect. In this implementation, the value of the state field is used to construct a file path without proper sanitization.

An attacker can inject a path traversal sequence (e.g., ../) or a direct filename into the state field. When the Logpoint server processes this response, it attempts to delete a file based on the attacker-controlled filename. By targeting critical SAML configuration files, session files, or other essential system files, the attacker can disrupt the SAML authentication flow.

The core issue is a lack of input validation and the use of user-supplied data in file system operations (CWE-73: External Control of File Name or Path).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: Directly uses state parameter to delete a file
def process_saml_response(saml_response):
    state = saml_response.get('state')
    # No sanitization or validation
    file_path = f"/var/logpoint/saml/sessions/{state}"
    os.remove(file_path)

Patched Code (Conceptual):

# Patched: Validates and sanitizes the state parameter
import re

def process_saml_response(saml_response):
    state = saml_response.get('state')
    # Validate state is a known session ID
    if not re.match(r'^[a-zA-Z0-9\-_]+$', state):
        raise ValueError("Invalid state parameter")
    # Use a whitelist of allowed files or a safe directory
    file_path = f"/var/logpoint/saml/sessions/{state}"
    if not os.path.exists(file_path):
        return
    os.remove(file_path)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a SAML SSO-URL endpoint for a Logpoint instance running version < 6.0.3.
• Ability to intercept or craft SAML responses.

Exploitation Steps:

1. Intercept a legitimate SAML SSO-URL response from the Logpoint server.
2. Modify the state parameter to contain a path to a critical file. For example:
   • state=../../config/saml_config.xml (to delete SAML configuration)
   • state=../../sessions/active_sessions.db (to delete session database)
3. Forward the crafted response to the Logpoint server.
4. The server will process the response and delete the targeted file.
5. This will cause a SAML authentication outage, preventing users from logging in.

Example Crafted URL (Conceptual):

https://logpoint-server/saml/SSO?SAMLRequest=...&RelayState=...&state=../../config/saml_config.xml

Blue Team

Detection:

• Monitor for unusual SAML responses with suspicious state parameters.
• Alert on file deletion events in the SAML-related directories.
• Monitor for sudden SAML authentication failures.

Hunting:

• Search logs for os.remove or file deletion operations on SAML-related paths.
• Look for SAML responses where the state parameter contains path traversal characters (../, ..\\).

Prevention:

• Ensure Logpoint SAML Authentication is upgraded to version 6.0.3 or later.
• Implement network segmentation to restrict access to the SAML endpoint.
• Use a Web Application Firewall (WAF) to filter malicious SAML responses.

Indicators of Compromise (IOCs)

• File Paths:
  • /var/logpoint/saml/config/saml_config.xml
  • /var/logpoint/saml/sessions/
  • /var/logpoint/saml/certs/
• Log Entries:
  • File deleted: /var/logpoint/saml/config/saml_config.xml
  • SAML authentication failure: Invalid state parameter
• Network Patterns:
  • SAML responses with state parameter containing ../ or ..\\.
  • Unusual SAML SSO-URL requests from unexpected IP addresses.

Detection Engineering

YARA Rule

rule CVE_2024_36383_SAML_File_Delete {
    meta:
        description = "Detects attempts to exploit CVE-2024-36383 by looking for path traversal in SAML state parameter"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-36383"
    strings:
        $s1 = "state=" nocase
        $s2 = "../" nocase
        $s3 = "..\\" nocase
    condition:
        $s1 and ($s2 or $s3)
}

Sigma Rule

title: CVE-2024-36383 - Logpoint SAML File Deletion via State Parameter
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file deletion events related to SAML configuration files in Logpoint.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36383
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'path'
        key: '/var/logpoint/saml/'
        op: 'deleted'
    condition: selection
falsepositives:
    - Legitimate SAML configuration updates
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-36383 - Logpoint SAML File Deletion Attempt"; flow:to_server,established; content:"state="; nocase; content:"../"; distance:0; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Logpoint SAML Authentication to version 6.0.3 or later.
2. Workaround: If immediate patching is not possible, restrict network access to the SAML SSO-URL endpoint to trusted IP addresses only.
3. Validation: Implement strict input validation on the state parameter at the application layer or via a reverse proxy.
4. Monitoring: Enable detailed logging for SAML authentication and file system operations. Alert on any suspicious file deletions.
5. Backup: Ensure regular backups of SAML configuration files are taken to facilitate quick recovery.

Valters IT
DevSecOps & Cyber Threat Intelligence