Snipe-IT Authentication Bypass via SAML Username Case Sensitivity

Executive Summary

Snipe-IT before version 8.7.0 has a vulnerability where it fails to validate username case sensitivity during SAML authentication. Attackers can register Identity Provider accounts with accent or case variants of victim usernames, exploiting the default utf8mb4_unicode_ci database collation to bypass username matching and gain unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

Check Snipe-IT version with: grep -r "version" /path/to/snipe-it/config/app.php. If version is below 8.7.0, the system is vulnerable. Inspect database collation for users.username column with: SELECT TABLE_NAME, COLUMN_NAME, COLLATION_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = 'your_database' AND COLUMN_NAME = 'username' AND TABLE_NAME = 'users';

Review authentication logs for SAML/LDAP/OAuth login attempts with unusual case or accented usernames. Look for patterns like 'snípeitreport3' vs 'snipeitreport3' in access logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to log in as another user without credentials, potentially accessing sensitive data or performing unauthorized actions. The attack requires minimal privileges, no victim interaction, and works across SAML, LDAP, and OAuth login paths.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, which may violate compliance requirements under GDPR (e.g., unauthorized data access under Article 32) and HIPAA (e.g., unauthorized access to protected health information under the Security Rule). The lack of proper username validation during authentication undermines security controls required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later immediately. If upgrading is not possible, apply the patch from commit 2304066d79 which adds the verifyExactUsernameMatch filter to prevent collation bypass.

Temporarily disable federated login paths (SAML, LDAP, OAuth) until patched. Review and remove any IdP accounts with case or accent variants of existing usernames.

Useful 0 Not Useful 0