Description
The SAML SSO Service Provider module provides SAML 2.0 Single Sign On, letting a Drupal site act as a service provider that authenticates its users against an external identity provider.
On every request the module implements SecKit's options alter hook and pushes entries onto SecKit's cross origin CSRF origin whitelist, including the configured identity provider origin and an opaque origin value, without limiting the change to its own assertion consumer service endpoint, so on any site that also runs SecKit with origin based CSRF protection the relaxation applies to every path rather than only to the endpoint that receives the identity provider POST.
This vulnerability is mitigated by the fact that it only affects sites running both this module and SecKit with origin protection enabled, that Drupal's own per form tokens still protect standard form submissions, and that whether a browser can be made to present a whitelisted origin depends on the site's configuration and on the SecKit release in use.
Solution
Install the latest version.
If you use the SAML SSO - Service Provider module for Drupal 7, upgrade to SAML SSO - Service Provider 7.x-2.75:
Sites that do not run SecKit, or that run it with origin based cross site request forgery protection turned off, were never affected. No database update is required and no configuration has to change after upgrading.
Reported by
Fixed by
Coordinated by
- Tag1 D7ES