Project
SAML SSO - Service Provider
Date
Severity
Critical
Risk Score
15/25 AC:Basic/A:None/CI:None/II:Some/E:Exploit/TD:Default
Vulnerability
Open Redirect
Affected versions
<7.x-2.75

Description

The SAML SSO Service Provider module lets a Drupal site act as a SAML service provider so that visitors sign in through an external identity provider.

The module takes the SAML RelayState value, which the identity provider echoes back from a request the attacker influenced and which the signature does not protect, and hands it to the post login redirect without confirming that it points at the local site, so a completed login can be steered to any external address.

This vulnerability is mitigated by the requirement that SAML login is enabled and that the victim first follows a request the attacker prepared, yet the redirect still carries the authority of the genuine site and so makes convincing phishing possible.

Solution

Install the latest version.

If you use the SAML SSO - Service Provider module for Drupal 7, upgrade to SAML SSO - Service Provider 7.x-2.75:

Reported by

Fixed by

Coordinated by