External risk intelligence

Mendix SAML Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-29129

The vulnerability exists in the Mendix SAML module, which is a core component used to handle identity and authentication for web applications. SAML service providers and identity portals are designed to be public-facing to facilitate user authentication from various networks, making them internet-accessible by design in typical application deployments.

Authentication Bypass

Mendix Saml

1.16.4 to before 1.18.02.2.0 to before 2.4.03.1.8 to before 3.6.1

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Mendix SAML module could allow unauthenticated attackers to bypass authentication and access applications. This issue arises from insufficient verification of SAML assertions, potentially impacting any application using the affected Mendix SAML module. The primary concern is confirming relevance and exposure to understand the potential impact on our systems.

Attackers could bypass application logins.
SAML authentication bypass could expose applications.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could reach the Mendix SAML module over the network, as it's often publicly exposed for authentication. The module's failure to properly verify SAML assertions means an attacker could craft a malicious assertion to bypass login and gain unauthorized access.

Network exposure required.
Incomplete SAML assertion verification.
Unauthenticated remote access possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated remote attackers to bypass authentication and gain unauthorized access to applications that use the Mendix SAML module, when the module insufficiently verifies SAML assertions.

Application access and user data.
Unauthenticated remote bypass.
Unauthorized access to applications.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are primarily responsible for addressing this vulnerability in the Mendix SAML module. The first practical step is to identify all instances of the affected module across your Mendix applications, confirm their exposure and business criticality, and then assign an accountable owner for remediation. Planning for updates should consider the identified risks and potential impact on application availability.

Assign ownership to application or platform teams.
Verify exposure and business criticality of instances.
Plan and coordinate remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Mendix SAML module used for?

The Mendix SAML module is a plug-in component integrated into Mendix applications to handle user authentication. It acts as a bridge between the application and an identity provider, allowing users to log in using single sign-on (SSO) protocols. By managing the exchange of security assertions, it ensures that only authorized users can access the application's features and data.

How does the CVE-2023-29129 vulnerability work?

This vulnerability involves improper authentication, specifically categorized under CWE-287 and CWE-303. It occurs because the module fails to sufficiently verify the SAML assertions—the digital tokens used to confirm a user's identity. Because the system does not fully validate these tokens, an attacker can provide a forged assertion that the application mistakenly accepts as legitimate, allowing them to bypass the login process entirely.

Can this be triggered by any user?

The vulnerability requires the application to be using a specific, non-default configuration where the SAML assertion verification is incomplete. It does not trigger during standard, properly secured authentication flows. The issue is a residual flaw from a previous incomplete fix, meaning it only becomes a risk if the environment relies on the specific logic that failed to be fully patched in the affected versions.

Is my application at risk?

According to Halo Surface Signal, this risk is very likely for many deployments because the Mendix SAML module is designed to be internet-facing. Since these identity portals must be reachable to allow users to authenticate from various networks, they are inherently exposed. If your Mendix application exposes its login interface to the public internet, it falls into the category of systems that are potentially accessible to remote attackers.

What is the first step to address this?

Start by auditing your application landscape to create a complete inventory of all Mendix modules in use. Once you have identified which applications utilize the affected versions of the SAML module, assess the business criticality of those specific systems. Coordinate with your platform teams to confirm which instances are internet-facing and prioritize those for update planning to mitigate the risk of unauthorized access.

References

cert-portal.siemens.com/productcert/pdf/ssa-851884.pdf

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.