Headline

CVE-2022-23610: Release 2022-01-27 · wireapp/wire-server

wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft DSA Signatures to bypass SAML SSO and impersonate any Wire user with SAML credentials. In teams with SAML, but without SCIM, it was possible to create new accounts with fake SAML credentials. Under certain conditions that can be established by an attacker, an upstream library for parsing, rendering, signing, and validating SAML XML data was accepting public keys as trusted that were provided by the attacker in the signature. As a consequence, the attacker could login as any user in any Wire team with SAML SSO enabled. If SCIM was not enabled, the attacker could also create new users with new SAML NameIDs. In order to exploit this vulnerability, the attacker needs to know the SSO login code (distributed to all team members with SAML credentials and visible in the Team Management app), the SAML EntityID identifying the IdP (a URL not considered sensitive, but usually hard to guess, also visible in Team Management), and the SAML NameID of the user (usually an email address or a nick). The issue has been fixed in wire-server 2022-01-27 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-01-27, so that their backends are no longer affected. There are currently no known workarounds. More detailed information about how to reproduce the vulnerability and mitigation strategies is available in the GitHub Security Advisory.

3 years ago

CVE

Open in Source

#vulnerability #web #git #java

Releases
v2022-01-27

Release notes

The nginz chart now configures nginx to only allow cross-origin requests from an explicit allow list of subdomains. By default these are:

nginz: nginx_conf: allowlisted_origins: - webapp - teams - account

If you changed the names of these services, you must adjust those names in the nginz config as well. (#1630)
Backend now separates conversation access control for guests and services. The old access roles are still supported but it is encouraged to upgrade clients since mapping between the old access roles and the new access roles is not isomorphic. For more details refer to the API changes below or the Swagger docs.
Old clients are fully supported; if new clients and old clients are mixed, to old clients, either guests of services may appear to be enable if they are not, which may lead to error messages (confusing but harmless). (#2035)

API changes

Endpoints that recently have accepted access_role in their payload will now accept access_role_v2 as well which will take precedence over access_role. See Swagger docs for how values are mapped. Endpoints that recently have returned access_role in their payload will now additionally return the access_role_v2 field. (#2035)

Features

Conversation access roles now distinguish between guests and services. (#2035)

Bug fixes and other updates

There is now an explicit CORS allow list for all endpoints. In previous releases, all subdomains were accepted, however they must now be listed explicitly. This is a breaking change, as now only known Javascript applications may access the backend. (#1630)
Prevent 500s when SFTs are not reachable from Backend (#2077)

Internal changes

Bump hsaml2 package version (#2075)
Separate Spar.Data module into smaller Cassandra interpreters (#2064)
Fix some HLint issues in libs/wire-api. (#2065)
Fix broken build process of package “old-time” for some environments (#2056)
Refresh license headers (#2062)
Rename Spar.Sem.ScimTokenStore.GetByTeam to LookupByTeam (#2068)
(Try syntax change in config file that breaks nginz (#2073, reverted in a4a6193))

Federation changes