Tag1 D7ES Security Advisories

The SAML SSO Service Provider module relies on several weak cryptographic practices while validating incoming SAML signatures, comparing HMAC signatures without a constant time comparison, generating XML message identifiers from a source of randomness that is not cryptographically secure, and anchoring trust on the SHA1 thumbprint of the signing certificate rather than on the whole configured certificate. Together these weaken the assurance that a SAML message the site accepts genuinely originated from the configured identity provider.

The module does not sufficiently force certain uploaded file types to download when served. Under certain site configurations, a file uploaded through a webform could be rendered inline by a browser, resulting in a cross-site scripting vulnerability.

An earlier release of the module saved the miniOrange account password of the administrator who registered the module as a cleartext site variable, and later releases stopped writing it but never removed the stored copy, so the password persists in the database and in every backup on upgraded sites.

The module ships a shared miniOrange customer identifier and API key inside its source code and falls back to that pair to sign requests to the miniOrange service whenever a site has not configured its own credentials, so anyone who downloads the module can extract the secret and mint validly signed requests to the vendor API under a customer identity shared across many other installations.

An anonymous attacker can seed a certificate they control into the module's configuration through the unauthenticated assertion endpoint and then promote it to the live SAML trust anchor through a tokenless endpoint that is open to anonymous users, after which responses signed with the attacker's own certificate are trusted and the attacker can log in as any account, including an administrator.

The miniorange_saml module uses the attacker controllable SAML RelayState as the redirect target after a successful login without checking that it stays on the local site, so an attacker can turn a login into a redirect to an arbitrary external URL. Because the outbound RelayState was copied from the HTTP referer header, an ordinary visitor can be sent off the site after a single click on a page the attacker controls.

The aggregate report block reads a table name from the request query string and interpolates it into SQL without validation, allowing an attacker to read the contents of any table in the database (including Drupal's user credentials) and to inject SQL.

The module renders administrator supplied configuration values into administration pages and into a publicly reachable SAML metadata document without escaping them, allowing stored script to run in the browser of anyone who views those outputs.

The module accepts a signed SAML response without recording that the response has already been consumed and without enforcing the validity window carried in the assertion, so a captured valid response can be posted to the assertion consumer endpoint repeatedly to open a new session each time, and an assertion whose lifetime has already passed is still accepted.

The module renders the contents of imported CSV tables through an aggregate report block with no access control, allowing any visitor, including anonymous users, to read the imported data once the block is placed.