Project
SAML SSO - Service Provider
Date
Severity
Highly Critical
Risk Score
20/25 AC:Basic/A:None/CI:All/II:All/E:Proof/TD:Default
Vulnerability
Access Bypass
Affected versions
<7.x-2.75

Description

The SAML SSO Service Provider module lets a Drupal site act as a SAML service provider so that users authenticate through an external identity provider.

The module writes the certificate and issuer copied from an incoming SAML response into global configuration before that response is cryptographically verified, and it exposes the endpoint that promotes those stored values into the live identity provider trust settings to anonymous requests with no token, so an attacker who posts a response signed with their own certificate can then call that endpoint and make their certificate the trusted signing key for future logins.

This vulnerability is mitigated only by the requirement that the module is enabled and operating as a configured service provider, because both the assertion endpoint and the promotion endpoint are reachable by anonymous users in the default configuration.

Solution

Install the latest version.

If you use the SAML SSO - Service Provider module for Drupal 7, upgrade to SAML SSO - Service Provider 7.x-2.75:

Reported by

Fixed by

Coordinated by