ION Group: Account Takeover

### Summary The default configuration of authentication component of Wallstreet WebSuite application does not validate the SAML response from the identity provider (e.g. Microsoft login) which can be leveraged to takeover accounts of other users by modifying the email address and username assertion fields. This can be abused to take over the application components such as Cash Manager Module [CMM] and Security Center (administration component) ### Severity Critical - An authenticated user with valid credentials can access any existing user account, such as a super administrator account, without the knowledge of target user’s valid credentials. An attacker would then be able to access all information and initiate actions while impersonating the account. ### Proof of Concept Following steps can be followed to replicate the vulnerability: 1. Access the application using the URL and note the “RelayState” parameter in the response: https://<hostname>:<port>/websuite/saml 2. The application redirects to login to the Identity Provider (IdP) portal e.g. Microsoft. On successful login, a SAML response is generated. 3. Retrieve the “SAMLResponse” value either by inspecting the traffic with browser Dev Tools or using an interception proxy such as Burp Suite. 4. The SAML response is base64 encoded and can be easily decoded to view the plain text contents. Replace the username and email addresses in the decoded SAML response with those of another user such as an administrative user. 5. Base64 encode the tampered SAML response and issue a request to the /saml/response endpoint of the application using the “RelayState” parameter obtained in step 1. 6. The application authorizes the user based on the SAML token and issues a session token. Security Center compromise The aforementioned steps can be followed to gain super administrator access to Security Center as well. 1. Access the Security Center directly using the URL or tile from the WebSuite home page. 2. Authentication redirects to identity provider (IdP) after issuing of RelayState parameter. 3. Login at the IdP’s portal e.g. Microsoft login in this case. SAML response is returned to the Web Suite authentication endpoint 4. SAML Response is tampered to change the username and email address to that of administrator account. This can be done manually or using BurpSuite extension such as SAMLRaider. The modified SAML response is forwarded to the application which redirects to the Security Center page. ### Further Analysis Google / Mandiant recommends properly validating the signature/Certificate along with the assertion data originating from the IDP. ### Timeline **Date reported**: 07/23/2024 **Date fixed**: **Date disclosed**: 10/22/2024

Severity from

GitHub (reviewed advisory)

• github.com/google/security-research/security/advisories/GHSA-mc96-8hxm-24m9
• github.com/google/security-research