CVE-2024-41107— Apache CloudStack: SAML Signature Exclusion
Quick assessment
Affected
Apache Software Foundation Apache CloudStack
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache CloudStack是美国阿帕奇（Apache）基金会的一套基础架构即服务（IaaS）云计算平台。该平台主要用于部署和管理大型虚拟机网络。 Apache CloudStack存在安全漏洞，该漏洞源于身份验证不强制执行签名检查，攻击者可以通过提交没有签名的欺骗SAML响应以及启用SAML的CloudStack用户帐户来绕过SAML身份验证。
Public Exploits 1
Nuclei · 1
CVE-2024-41107.yaml [template]
Possible ATT&CK Techniques 1 AI
T1110.004 · Credential Stuffing
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-41107
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache CloudStack: SAML Signature Exclusion
Source: CVE Program / CVE List V5
Vulnerability Description
The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response with no signature and known or guessed username and other user details of a SAML-enabled CloudStack user-account. In such environments, this can result in a complete compromise of the resources owned and/or accessible by a SAML enabled user-account.
Affected users are recommended to disable the SAML authentication plugin by setting the "saml2.enabled" global setting to "false", or upgrade to version 4.18.2.2, 4.19.1.0 or later, which addresses this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
Apache CloudStack 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache CloudStack是美国阿帕奇（Apache）基金会的一套基础架构即服务（IaaS）云计算平台。该平台主要用于部署和管理大型虚拟机网络。 Apache CloudStack存在安全漏洞，该漏洞源于身份验证不强制执行签名检查，攻击者可以通过提交没有签名的欺骗SAML响应以及启用SAML的CloudStack用户帐户来绕过SAML身份验证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.5.0 ~ 4.18.2.1 | - |
|
II. Public POCs for CVE-2024-41107
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | This repository contains an PoC for the critical vulnerability identified as CVE-2024-41107 in Apache CloudStack | https://github.com/d0rb/CVE-2024-41107 | POC Details |
| 2 | The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response with no signature and known or guessed username and other user details of a SAML-enabled CloudStack user-account | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-41107.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-41107
请登录查看更多情报信息。
Mailing List Discussions for CVE-2024-41107 (3)
Security Blog Posts for CVE-2024-41107 (1)
Other References for CVE-2024-41107 (2)
-
https://github.com/apache/cloudstack/issues/4519 issue-tracking
Same Patch Batch · Apache Software Foundation · 2024-07-19 · 4 CVEs total
| CVE-2024-41172 | Apache CXF: Unrestricted memory consumption in CXF HTTP clients | |
| CVE-2024-32007 | Apache CXF Denial of Service vulnerability in JOSE | |
| CVE-2024-29736 | Apache CXF: SSRF vulnerability via WADL stylesheet parameter |
IV. Related Vulnerabilities
Same product: Apache CloudStack
-
CVE-2026-59654
Apache CloudStack: DoS caused by database connections leak -
CVE-2026-47359
Apache CloudStack: OS Command Injection due to unsanitized m -
CVE-2026-50112
Apache CloudStack: RCE and SSRF in direct download, metalink -
CVE-2026-50222
Apache CloudStack: Improper access control in Userdata refer -
CVE-2026-59085
Apache CloudStack: Server-Side Request Forgery (SSRF) vulner
Same vendor: Apache Software Foundation
-
CVE-2026-63686
Apache HTTP Server: mod_xml2enc crash on charset conversion -
CVE-2026-93546
Apache HTTP Server: mod_dav_fs namespace overflow -
CVE-2026-79768
Apache HTTP Server: mod_userdir information disclosure -
CVE-2026-73637
Apache HTTP Server: mod_auth_digest DoS attack -
CVE-2026-73636
Apache HTTP Server: mod_auth_digest one-time-nonce replay at
Same weakness: CWE-290
-
CVE-2026-103347
WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerabi -
CVE-2026-103397
OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoof -
CVE-2026-97274
WordPress OAuth Single Sign On – SSO (OAuth Client) plugin < -
CVE-2026-97249
WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass -
CVE-2026-96825
WordPress All In One WP Security & Firewall plugin <= 5.4.8
V. Comments for CVE-2024-41107
No comments yet