CVE-2016-8638: Session Fixation in ipsilon

CVE-2016-8638 · Severity: critical · CVSS 9.1 · Published 2022-05-14

Ipsilon is an open-source identity provider and SAML authentication server used to manage user sessions and federated logins. An unauthenticated attacker can forcibly log out active sessions of other users by exploiting flawed session tracking logic, disrupting legitimate users' access and potentially enabling account takeover attacks.

Technologies: ipsilon (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2016-8638 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2016-8638 being exploited in the wild.
How severe is CVE-2016-8638?
Critical severity, with a CVSS score of 9.1, published 14 May 2022.
Which products and versions are affected?
ipsilon (PyPI) >= 2.0.0, < 2.0.2, ECOSYSTEM:introduced=1.0.0,fixed=1.0.3,introduced=1.1.0,fixed=1.1.2,introduced=2.0.0,fixed=2.0.2,introduced=1.2.0,fixed=1.2.1, ECOSYSTEM:introduced=2.0.0,fixed=2.0.2.
Is there a fix for CVE-2016-8638?
Yes. ipsilon (PyPI): upgrade to 1.2.1, 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-8638 attacked?
It is attacked over the network.
Am I affected by CVE-2016-8638?
Check whether you run ipsilon (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ipsilon (PyPI): upgrade to 1.2.1, 2.0.2 or later
    pip install "ipsilon>=2.0.2"

Technical details

This is a session fixation and multi-session vulnerability (CWE-384) in Ipsilon's SAML2 implementation. The vulnerable code incorrectly allows unauthenticated attackers to trigger logout operations for any session by manipulating session-related parameters, regardless of which user owns the session. The issue stems from insufficient authorization checks on the logout endpoint. No authentication is required; the attacker only needs network access to the Ipsilon server. An attacker can enumerate and terminate sessions of other users, causing denial of service and potential session hijacking. Patches are available in versions 2.0.2, 1.2.1, 1.1.2, and 1.0.3.

Affected products

  • Ipsilon Project Ipsilon 2.0.0 before 2.0.2, 1.2.0 before 1.2.1, 1.1.0 before 1.1.2, 1.0.0 before 1.0.3

Identifiers

  • CVE-2016-8638
  • GHSA-376m-3rm2-9jm6
  • PYSEC-2026-360

Timeline

  • 2017-07-12: disclosed: CVE-2016-8638 published by NVD
  • 2016-11: patched: Fix committed to repository in November 2016

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.