SAML SSO Information Disclosure in Omada Controller

Executive Summary

This is an information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller. It occurs because the system does not properly validate user-supplied SAML metadata, allowing an authenticated user with SAML configuration privileges to exploit an XML External Entity (XXE) injection. This can lead to unauthorized access to sensitive information, including arbitrary local file reads.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual SAML metadata processing or XML External Entity (XXE) injection attempts in Omada Controller logs. Check for unauthorized file access patterns or unexpected data exposure in network traffic involving the controller. Review logs for users with SAML configuration privileges performing unexpected actions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with SAML configuration privileges could exploit this to read sensitive files on the system, potentially exposing confidential data such as credentials, configuration files, or other sensitive information stored locally. This could lead to further compromise of the network or systems managed by the Omada Controller.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected Omada Controller versions may face legal and regulatory penalties if sensitive data is exposed due to this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Omada Controller to the latest firmware version provided by TP-Link. Restrict SAML configuration privileges to only necessary users. Disable unnecessary XML parsing features if possible. Monitor for suspicious activity and apply network segmentation to limit exposure.

Useful 0 Not Useful 0