CVE-2024-41107highCWE-290

CVE-2024-41107: high-severity vulnerability in Apache CloudStack

Apache CloudStack: SAML Signature Exclusion

Published · Updated

Follow this CVE+ Monitor Apache CloudStack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8.1epss 18%
In short

Apache CloudStack's SAML authentication can be bypassed by submitting a fake login response without a signature, allowing attackers to impersonate any SAML user. This is critical because it grants full access to all resources controlled by the compromised account.

Technical detail

CVE-2024-41107 exploits improper signature validation in CloudStack's SAML authentication module (disabled by default). An unauthenticated attacker can forge a SAML response without cryptographic signature verification, bypassing authentication if SAML is enabled and the attacker knows or guesses a target username. Successful exploitation results in complete account takeover and unauthorized access to cloud resources.

Summary generated and translated by AI from the official description.
The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response with no signature and known or guessed username and other user details of a SAML-enabled CloudStack user-account. In such environments, this can result in a complete compromise of the resources owned and/or accessible by a SAML enabled user-account. Affected users are recommended to disable the SAML authentication plugin by setting the "saml2.enabled" global setting to "false", or upgrade to version 4.18.2.2, 4.19.1.0 or later, which addresses this issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache CloudStack
Related CVEs — Apache CloudStack

In the same product, most dangerous first.

CVE-2022-35741—Apache CloudStack SAML Single Sign-On XXEEPSS 8.0%CVE-2016-6813—CVE-2016-6813EPSS 5.6%CVE-2024-38346CRITICALApache CloudStack: Unauthenticated cluster service port leads to remote executionEPSS 3.3%CVE-2026-61400HIGHApache CloudStack: Get and Run Diagnostics Command InjectionEPSS 2.9%CVE-2022-26779—Apache Cloudstack insecure random number generation affects project email invitationEPSS 2.9%CVE-2025-22828MEDIUMApache CloudStack: Unauthorised access to annotationsEPSS 2.1%