CVE-2014-0034: Input Validation
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.
Other sources
The SecurityTokenService (STS) provided as part of Apache CXF has bindings to issue, validate, renew and cancel tokens. The main use-case is to issue SAML tokens. However, a less common use-case is to use the STS to validate SAML tokens. The vulnerability is that there are certain circumstances in which the STS will accept an invalid SAML token as valid if caching is enabled.
Affected versions: Apach CXF 2.6.x < 2.6.12 Apach CXF 2.7.x < 2.7.9
Note from apache advisory: Although this vulnerability has been fixed in CXF 2.6.12 and 2.7.9, due to other security advisories it is recommended to upgrade to the following releases: CXF 2.6.x users should upgrade to 2.6.14 or later as soon as possible. CXF 2.7.x users should upgrade to 2.7.11 or later as soon as possible.
References: http://cxf.apache.org/security-advisories.data/CVE-2014-0034.txt.asc
Upstream fix: http://svn.apache.org/viewvc?view=revision&revision=1551228
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0034?
CVE-2014-0034 has been classified as a high severity vulnerability due to improper validation of SAML tokens.
How do I fix CVE-2014-0034?
To fix CVE-2014-0034, upgrade your Apache CXF installation to version 2.6.12 or later, or 2.7.9 or later.
What software is affected by CVE-2014-0034?
CVE-2014-0034 affects Apache CXF versions prior to 2.6.12 and 2.7.x prior to 2.7.9.
Can CVE-2014-0034 allow unauthorized access?
Yes, CVE-2014-0034 can allow remote attackers to gain unauthorized access through invalid SAML tokens.
Is there a specific configuration to review for CVE-2014-0034?
Review the configuration of the SecurityTokenService (STS) for proper token validation when caching is enabled to mitigate CVE-2014-0034.