Simplify User Access Management with SCIM on Rapid7 Command Platform
A credential leak at Simplify User is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.
A credential leak at Simplify User is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.
Anyone connected to Simplify User through the compromised trust relationship is potentially affected, not just Simplify User itself.
A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.
The trust mechanism involved here is a federated identity (SSO/SAML) trust relationship, which is what let access move between otherwise unrelated systems.
Simplify User says the credential has been revoked, and no exploitation has been confirmed so far.
If you have any integration or dependency involving Simplify User, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.
What happened
A credential leak at Simplify User is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.
Who is affected
Anyone connected to Simplify User through the compromised trust relationship is potentially affected, not just Simplify User itself.
Why it matters
A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.
Technical details
The trust mechanism involved here is a federated identity (SSO/SAML) trust relationship, which is what let access move between otherwise unrelated systems.
Response
Simplify User says the credential has been revoked, and no exploitation has been confirmed so far.
What security teams should do
If you have any integration or dependency involving Simplify User, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.