CyberRota Analysis
AI-GeneratedProwler's SAML authentication flow prior to version 5.30.3 is vulnerable to cross-tenant account takeover due to improper validation of the email domain in SAML responses. An authenticated attacker with control over a SAML Identity Provider (IdP) can exploit this flaw to issue tokens for unintended tenants, potentially compromising sensitive data. Organizations using Prowler should prioritize upgrading to version 5.30.3 to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.