VYPR
← All advisories
Critical severityNVD Advisory· Published Jul 20, 2023· Updated Oct 24, 2024

User impersonation using SAMLv1.x SSO in Open Access Management

CVE-2023-37471

Description

Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. This problem has been patched in OpenAM 14.7.3-SNAPSHOT and later. User unable to upgrade should comment servlet SAMLPOSTProfileServlet from their pom file. See the linked GHSA for details.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.openidentityplatform.openam:openam-federation-libraryMaven
< 14.7.314.7.3

Affected products

1

Patches

1
7c18543d126e

GHSL-2023-143, GHSL-2023-144, deny unsigned SAML response (#624)

https://github.com/OpenIdentityPlatform/OpenAMMaxim ThomasJul 18, 2023via ghsa
commit
1 file changed · +10 −6
  • openam-federation/openam-federation-library/src/main/java/com/sun/identity/saml/common/SAMLUtils.java+10 −6 modified
    @@ -951,6 +951,10 @@ public static Response getResponse(byte [] bytes) {
      */
     public static boolean verifyResponse(Response response,
     String requestUrl, HttpServletRequest request) {
+        if(!response.isSigned()) {
+            debug.message("verifyResponse: Response is not signed");
+            return false;
+        }
         if (!response.isSignatureValid()) {
             debug.message("verifyResponse: Response's signature is invalid.");
             return false;
@@ -1585,13 +1589,13 @@ public static Map processResponse(Response samlResponse, String target)
         List assertions = null;    
         SAMLServiceManager.SOAPEntry partnerdest = null;
         Subject assertionSubject = null;
-        if (samlResponse.isSigned()) {
-            // verify the signature
-            boolean isSignedandValid = verifySignature(samlResponse);
-            if (!isSignedandValid) {
-                throw new SAMLException(bundle.getString("invalidResponse"));
-            }
+
+        // verify the signature
+        boolean isSignedandValid = verifySignature(samlResponse);
+        if (!isSignedandValid) {
+            throw new SAMLException(bundle.getString("invalidResponse"));
         }
+
         // check Assertion and get back a Map of relevant data including,
         // Subject, SOAPEntry for the partner and the List of Assertions.
         Map ssMap = verifyAssertionAndGetSSMap(samlResponse);

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.