Description
The SAML SSO Service Provider module adds SAML 2.0 single sign on and lets an administrator configure a trusted identity provider, including by fetching the provider metadata document from a remote URL on the service provider setup form.
When retrieving that document over HTTPS the module built a stream context that explicitly turned off TLS peer and hostname verification, so a party able to intercept the connection could return a metadata document of their choosing and the module would save the attacker supplied signing certificate, issuer and login URL and set SAML login to enabled without any warning.
This vulnerability is mitigated by the fact that an attacker must both hold a privileged network position between the site and the metadata host and time the interception to the moment an administrator triggers a metadata fetch.
Solution
Install the latest version.
If you use the SAML SSO - Service Provider module for Drupal 7, upgrade to SAML SSO - Service Provider 7.x-2.75:
Reported by
Fixed by
Coordinated by
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Tag1 D7ES