Read the docs
TI-2024-32099 Aliases CVE-2024-47832GHSA-j2hr-q93x-gxvh

XML Signature Bypass via differential XML parsing in ssoready

Priority MEDIUM 48CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00401 34th percentileScored 2026-11-07
Fix Fixed ssoready (ssoready): 0.0.0-20241009153838-7f92a0630439github.com/ssoready/ssoready (Go): 0.0.0-20241009153838-7f92a0630439

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ssoreadyssoreadybefore 0.0.0-20241009153838-7f92a06304390.0.0-20241009153838-7f92a0630439Patch availableCNA
—github.com/ssoready/ssoready (Go)before 0.0.0-20241009153838-7f92a06304390.0.0-20241009153838-7f92a0630439Patch availableGHSA-j2hr-q93x-gxvh
  • ssoready Vendorssoready Affected before 0.0.0-20241009153838-7f92a0630439 Fixed in 0.0.0-20241009153838-7f92a0630439 Patch available CNA
  • github.com/ssoready/ssoready (Go) Vendor— Affected before 0.0.0-20241009153838-7f92a0630439 Fixed in 0.0.0-20241009153838-7f92a0630439 Patch available GHSA-j2hr-q93x-gxvh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ssoready:ssoready:*:*:*:*:*:*:*:*before 2024-10-09Vulnerablessoready
  • cpe:2.3:a:ssoready:ssoready:*:*:*:*:*:*:*:* Versions before 2024-10-09 Vulnerable ·ssoready

Remediation

  • Fix · CNA ssoready (ssoready) Fixed in 0.0.0-20241009153838-7f92a0630439
  • Fix · GHSA-j2hr-q93x-gxvh github.com/ssoready/ssoready (Go) Fixed in 0.0.0-20241009153838-7f92a0630439 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-47832
  2. 2026-10-03 Alias added: GHSA-j2hr-q93x-gxvh

References

Patch 1

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences