Executive brief
Ipsilon is an open-source identity provider and SAML authentication server used to manage user sessions and federated logins. An unauthenticated attacker can forcibly log out active sessions of other users by exploiting flawed session tracking logic, disrupting legitimate users' access and potentially enabling account takeover attacks.
Technical details
This is a session fixation and multi-session vulnerability (CWE-384) in Ipsilon's SAML2 implementation. The vulnerable code incorrectly allows unauthenticated attackers to trigger logout operations for any session by manipulating session-related parameters, regardless of which user owns the session. The issue stems from insufficient authorization checks on the logout endpoint. No authentication is required; the attacker only needs network access to the Ipsilon server. An attacker can enumerate and terminate sessions of other users, causing denial of service and potential session hijacking. Patches are available in versions 2.0.2, 1.2.1, 1.1.2, and 1.0.3.
Affected products
- Ipsilon Project Ipsilon 2.0.0 before 2.0.2, 1.2.0 before 1.2.1, 1.1.0 before 1.1.2, 1.0.0 before 1.0.3
Timeline
- 2017-07-12: disclosed: CVE-2016-8638 published by NVD
- 2016-11: patched: Fix committed to repository in November 2016