Description
The SAML SSO Service Provider module turns a Drupal site into a SAML Service Provider so users can authenticate through an external identity provider, and it uses a Service Provider private key to decrypt encrypted SAML assertions.
The module ships three usable RSA private keys together with their certificates in its resources directory, the same key material is present in every install, and the module ships no access rule of its own while the Drupal root configuration does not restrict files with the key, pem, cer or crt extensions, so any anonymous visitor can download the private keys directly over HTTP.
This vulnerability is mitigated by the fact that the disclosed key compromises only the confidentiality of encrypted SAML assertions rather than granting a login, because inbound assertions are verified with the identity provider key and not with this key, and it has effect only where a site has configured encrypted assertions.
Solution
Install the latest version.
If you use the SAML SSO - Service Provider module for Drupal 7, upgrade to SAML SSO - Service Provider 7.x-2.75:
After upgrading, run update.php so that database update 7202 deletes the private keys and certificates that earlier releases shipped and generates a keypair that belongs to this site alone. Sites whose identity provider sends encrypted assertions must then download the new Service Provider metadata and upload it to the identity provider, because the Service Provider certificate changes; until that is done encrypted assertions no longer decrypt. Assertions that are not encrypted are unaffected.
Reported by
Fixed by
Coordinated by
- Tag1 D7ES