Project
SAML SSO - Service Provider
Date
Severity
Critical
Risk Score
18/25 AC:None/A:None/CI:Some/II:Some/E:Proof/TD:Default
Vulnerability
Embedded API Credentials
Affected versions
<7.x-2.75

Description

The SAML SSO Service Provider module lets a Drupal site act as a SAML service provider so users can sign on through an external identity provider.

The module carries a fixed miniOrange customer identifier and API key inside its distributed source and uses that pair to sign outbound requests to the miniOrange service whenever the site has not saved its own credentials, so anyone who obtains the module can read the embedded secret and produce validly signed requests that the vendor accepts under a customer identity shared across many installations.

Because the exposed credential authenticates to the external miniOrange service rather than to this Drupal site, the confidentiality and integrity impact falls on that shared vendor tenant and on the support traffic that other sites send under the same identity, and it is limited by the fact that the affected asset is the external account rather than the local site.

Solution

Install the latest version.

If you use the SAML SSO - Service Provider module for Drupal 7, upgrade to SAML SSO - Service Provider 7.x-2.75:

Reported by

Fixed by

Coordinated by