Project
SAML SSO - Service Provider
Date
Severity
Critical
Risk Score
17/25 AC:None/A:Admin/CI:Some/II:Some/E:Exploit/TD:Default
Vulnerability
Cross Site Scripting
Affected versions
<7.x-2.75

Description

The SAML SSO Service Provider module lets a Drupal site act as a SAML service provider so users can sign on through an external identity provider.

The module renders administrator supplied configuration values, including the service provider base URL, the entity ID, the derived assertion consumer service URL, and user role names, directly into administration page output and into the SAML metadata document without escaping them, so a stored payload runs as script in the browser of anyone who views those outputs.

This vulnerability is mitigated by the fact that storing the malicious values requires the administer site configuration permission, although the resulting metadata document is served on an anonymously reachable path.

Solution

Install the latest version.

If you use the SAML SSO - Service Provider module for Drupal 7, upgrade to SAML SSO - Service Provider 7.x-2.75:

Reported by

  • Sudhanshu Dhage (sudhanshu0542)

Fixed by

Coordinated by