Improper Authentication in mod_auth_mellon - CVE-2019-3878

Vulnerability identifier: #VU18091

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-3878

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing certain headers. A remote attacker can add special HTTP headers that are normally used to start the special SAML ECP, bypass authentication process and gain unauthorized access to the application.

Successful exploitation of the vulnerability requires that Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users.

mod_auth_mellon
Amazon Linux AMI
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64
Fedora
libapache2-mod-auth-mellon (Ubuntu package)
httpd24 (Red Hat package)
mellon (Red Hat package)
mod_auth_mellon
httpd24-httpd (Red Hat package)

Install updates from vendor's website.

mod_auth_mellon - update to 0.14.2
libapache2-mod-auth-mellon (Ubuntu package) - addressed in versions 0.13.1-1ubuntu0.1, 0.14.0-1ubuntu0.1
httpd24 (Red Hat package) - update to mod_auth_mellon-0.13.1-2.el7.1
mellon (Red Hat package) - addressed in versions 0.14.0-2.el7_6.4, 0.14.0-3.el8_0.2
mod_auth_mellon - addressed in versions 0.14.0-5.fc29, 0.14.2-1.fc30
httpd24-httpd (Red Hat package) - addressed in versions 2.4.34-7.el6.1, 2.4.34-7.el7.1

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878
• https://github.com/Uninett/mod_auth_mellon/pull/196

• Multiple vulnerabilities in mod_auth_mellon Apache module
• Ubuntu update for mod_auth_mellon
• Amazon Linux AMI update for mod24_auth_mellon
• Fedora 30 update for mod_auth_mellon
• Fedora 29 update for mod_auth_mellon
• Red Hat Software Collections update for httpd24-httpd and httpd24-mod_auth_mellon
• Red Hat Enterprise Linux 7 update for mod_auth_mellon
• Red Hat Enterprise Linux 8 update for mod_auth_mellon