Project
SAML SSO - Service Provider
Date
Severity
Critical
Risk Score
15/25 AC:Complex/A:User/CI:Some/II:Some/E:Exploit/TD:Default
Vulnerability
SAML Assertion Replay and Unenforced Validity Window
Affected versions
<7.x-2.75

Description

The SAML SSO Service Provider module lets a Drupal site act as a SAML service provider so that users sign in through an external identity provider.

The module validates the signature on a SAML response but never remembers that a response was already used and never checks the NotBefore and NotOnOrAfter window that the assertion carries, so a captured valid response can be posted to the assertion consumer endpoint again and again to open a fresh authenticated session each time, and an assertion whose lifetime has already elapsed is accepted just the same.

This vulnerability is mitigated by the fact that an attacker must first obtain a valid signed response for a real user, for example from a proxy log, a browser history entry or an intercepted request, before it can be replayed.

Solution

Install the latest version.

If you use the SAML SSO - Service Provider module for Drupal 7, upgrade to SAML SSO - Service Provider 7.x-2.75:

After upgrading, run update.php so that database update 7200 creates the table that records the identifiers of consumed SAML assertions and responses. Until that update has run the module rejects every SAML login, because the replay check fails closed when the ledger table is missing.

Reported by

Fixed by

Coordinated by