CVE-2024-5250

Executive Summary

CVE-2024-5250 is a low-severity information disclosure vulnerability affecting the Akana API Platform prior to version 2024.1.0. The flaw resides in the SAML integration components, where overly verbose error messages can leak sensitive configuration or internal system details to an unauthenticated attacker. While the CVSS score is 3.5 (Low), the lack of a public proof-of-concept (PoC) and the low EPSS score (0.0%) suggest exploitation is currently unlikely. However, the vulnerability could be chained with other attacks to aid reconnaissance. No patch was available at the time of analysis, but upgrading to version 2024.1.0 is the recommended remediation.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low. The vulnerability only allows information disclosure through verbose error messages, with no direct impact on integrity or availability. The absence of public exploits and low EPSS score further reduce immediate risk.

Deep Dive & Mechanics

The vulnerability is rooted in the SAML (Security Assertion Markup Language) integration of the Akana API Platform. When processing SAML assertions or authentication requests, the platform may generate overly detailed error messages in response to malformed or invalid input. These error messages can include:

• Internal file paths
• Database connection strings
• Stack traces revealing software versions
• Configuration details (e.g., SAML certificate paths, endpoint URLs)

An attacker can trigger these verbose errors by sending crafted SAML requests (e.g., with invalid XML, missing signatures, or malformed assertions) to the SAML endpoint. The server responds with a detailed error message instead of a generic one, leaking information that can be used for further attacks.

Root Cause: The application fails to sanitize error output in the SAML handler, returning raw exception details to the client.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2024.1.0):

// SAML assertion handler
public Response handleSAMLRequest(SAMLRequest request) {
    try {
        // Process SAML
        Assertion assertion = parseAssertion(request);
        // ...
    } catch (Exception e) {
        // Verbose error: leaks stack trace and internal details
        return Response.status(400).entity(e.getMessage() + "\n" + e.getStackTrace()).build();
    }
}

Patched Code (2024.1.0+):

// SAML assertion handler
public Response handleSAMLRequest(SAMLRequest request) {
    try {
        // Process SAML
        Assertion assertion = parseAssertion(request);
        // ...
    } catch (Exception e) {
        // Generic error: no internal details leaked
        log.error("SAML processing error", e); // Log internally
        return Response.status(400).entity("Invalid SAML request").build();
    }
}

The patch replaces verbose error messages with a generic response, while logging the full details server-side for debugging.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Akana API Platform < 2024.1.0
• SAML endpoint exposed (e.g., /saml/SSO or /saml/ACS)

Exploitation Steps:

1. Identify the SAML endpoint (e.g., via Shodan or manual discovery).
2. Send a malformed SAML request to trigger verbose errors:

   curl -X POST "https://target.com/saml/SSO" \
     -H "Content-Type: application/xml" \
     -d '<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Version="2.0" IssueInstant="2024-01-01T00:00:00Z"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">invalid</saml:Issuer></samlp:AuthnRequest>'
   

3. Observe the response for verbose error messages containing internal paths, stack traces, or configuration details.
4. Use leaked information for further attacks (e.g., path traversal, credential stuffing).

No public exploit code is available.

Blue Team

Detection:

• Monitor for unusual SAML requests with malformed XML or invalid signatures.
• Alert on error responses containing stack traces, file paths, or database strings.
• Use the Sigma rule below to detect verbose error patterns in logs.

Mitigation:

• Upgrade to Akana API Platform 2024.1.0 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block responses containing common error patterns (e.g., Exception, Stack trace, at com.akana).
• Restrict access to SAML endpoints via network segmentation or IP whitelisting.

Indicators of Compromise (IOCs)

• Network:
  • HTTP responses with status 400/500 containing stack traces or internal paths.
  • SAML requests with invalid XML structure or missing required fields.
• Logs:
  • Application logs showing SAML processing error followed by verbose details.
  • Web server logs with 400 responses to SAML endpoints.
• File System:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_5250_Akana_SAML_Verbose_Error {
    meta:
        description = "Detects verbose error messages from Akana API Platform SAML integration"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-5250"
    strings:
        $s1 = "Exception" ascii wide nocase
        $s2 = "Stack trace" ascii wide nocase
        $s3 = "at com.akana" ascii wide nocase
        $s4 = "SAML" ascii wide nocase
        $s5 = "error" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) or (all of ($s4, $s5) and any of ($s1, $s2))
}

Sigma Rule

title: CVE-2024-5250 - Akana SAML Verbose Error Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects verbose error messages from Akana API Platform SAML integration
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        sc-status: 400
        cs-uri-query|contains: "saml"
        cs-uri-query|contains: "error"
    keywords:
        - "Exception"
        - "Stack trace"
        - "at com.akana"
    condition: selection and keywords
falsepositives:
    - Legitimate debugging during development
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-5250 - Akana SAML Verbose Error Leak";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"saml"; http_uri;
    content:"Exception"; http_server_body;
    content:"Stack trace"; http_server_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Upgrade to Akana API Platform version 2024.1.0 or later.
2. Workaround: If upgrade is not possible, implement a WAF rule to block responses containing Exception, Stack trace, or at com.akana.
3. Configuration: Ensure SAML endpoints return generic error messages (e.g., "Invalid request") and log detailed errors server-side.
4. Monitoring: Enable logging for SAML endpoints and alert on verbose error patterns.
5. Network: Restrict access to SAML endpoints to trusted IPs or VPN.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert