Project
SAML SSO - Service Provider
Date
Severity
Critical
Risk Score
18/25 AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:Default
Vulnerability
Weak Cryptographic Practices
Affected versions
<7.x-2.75

Description

The SAML SSO Service Provider module lets a Drupal site authenticate its users against an external identity provider using the SAML 2.0 protocol.

When it validates the signatures on incoming SAML messages the module compares HMAC digests without a constant time comparison, derives message identifiers from a predictable pseudo random generator instead of a cryptographically secure one, and decides whether the signing certificate is trusted by comparing only its SHA1 thumbprint rather than the full certificate that the administrator configured, so a party able to produce a certificate whose thumbprint collides with the expected one could have a forged message accepted as genuine.

This vulnerability is mitigated by the fact that defeating the certificate trust anchor requires computing a practical hash collision, the timing weakness applies only to deployments that verify messages with a shared HMAC key rather than the usual public key signatures, and the predictable identifiers matter only where the service provider signs or encrypts its own outbound messages, which this module does not do.

Solution

Install the latest version.

If you use the SAML SSO - Service Provider module for Drupal 7, upgrade to SAML SSO - Service Provider 7.x-2.75:

Reported by

Fixed by

Coordinated by