OTPulse
FeedAboutContact

Siemens Mendix SAML Module

Plan Patch8.3ICS-CERT ICSA-22-167-04Jun 14, 2022
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

The Mendix SAML module contains two vulnerabilities: an XML External Entity (XXE) injection flaw that could allow an authenticated attacker to disclose confidential data, and a Cross-Site Scripting (XSS) flaw that allows executing malicious code by tricking users into visiting a crafted URL. Both vulnerabilities affect the SAML authentication module used in Mendix 7, 8, and 9 applications. Siemens recommends updating to patched versions and implementing network access controls.

What this means
What could happen
An attacker with user access to a Mendix application could read sensitive data via XXE injection or execute malicious code in other users' browsers through XSS, potentially compromising application data and system access credentials.
Who's at risk
Organizations running Mendix applications (versions 7, 8, or 9) with the SAML authentication module should care. This affects any municipality, utility, or business that uses Mendix for web-based configuration, monitoring, or administrative interfaces, particularly those relying on SAML for single sign-on integrations.
How it could be exploited
An attacker with valid user credentials could submit a malicious SAML assertion containing an XXE payload to extract confidential data, or trick a user into clicking a specially crafted link containing XSS payload that executes in the context of the Mendix application. Both attacks require the attacker to reach the web application over the network.
Prerequisites
  • Valid user credentials to access the Mendix application
  • Network access to the Mendix application web interface on HTTP/HTTPS port
  • For XXE: ability to submit SAML assertions to the application
  • For XSS: ability to trick users into visiting attacker-controlled URL
remotely exploitablerequires valid user credentialsaffects data confidentiality and integritylow complexity exploitation
Exploitability
Low exploit probability (EPSS 0.4%)
Affected products (3)
3 with fix
ProductAffected VersionsFix Status
Mendix SAML Module (Mendix 8 compatible)<V2.2.22.2.2
Mendix SAML Module (Mendix 9 compatible)<V3.2.33.2.3
Mendix SAML Module (Mendix 7 compatible)<V1.16.61.16.6
Remediation & Mitigation
0/5
Do now
0/2
HARDENINGRestrict network access to Mendix applications using firewall rules to limit exposure to trusted administrative networks only
HARDENINGImplement input validation and output encoding controls in web application firewall (WAF) to block XSS attempts
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

Mendix SAML Module (Mendix 7 compatible)
HOTFIXUpdate Mendix 7 compatible SAML Module to v1.16.6 or later
Mendix SAML Module (Mendix 8 compatible)
HOTFIXUpdate Mendix 8 compatible SAML Module to v2.2.2 or later
Mendix SAML Module (Mendix 9 compatible)
HOTFIXUpdate Mendix 9 compatible SAML Module to v3.2.3 or later (note: v3.2.2 already resolves these issues for Mendix 9 upgrades)
View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/2caaa46b-13a8-4073-a37e-04bb9ec86c88