Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

Overview

Multiple SAML libraries may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Description

CWE-287: Improper Authentication

Security Assertion Markup Language (SAML) is an XML-based markup language for security assertions regarding authentication and permissions, most commonly used for single sign-on (SSO) services.

Some XML DOM traversal and canonicalization APIs may be inconsistent in handling of comments within XML nodes. Incorrect use of these APIs by some SAML libraries results in incorrect parsing of the inner text of XML nodes such that any inner text after the comment is lost prior to cryptographically signing the SAML message. Text after the comment therefore has no impact on the signature on the SAML message.

A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider

The following CVEs are assigned:

CVE-2017-11427 - OneLogin’s “python-saml”
CVE-2017-11428 - OneLogin’s “ruby-saml”
CVE-2017-11429 - Clever’s “saml2-js”
CVE-2017-11430 - “OmniAuth-SAML”
CVE-2018-0489 - Shibboleth openSAML C++
CVE-2018-5387 - Wizkunde SAMLBase

More information is available in the researcher’s blog post.

---

Impact

By modifying SAML content without invalidating the cryptographic signature, a remote, unauthenticated attacker may be able to bypass primary authentication for an affected SAML service provider.

---

Solution

Apply updates

Affected SAML service providers should update software to utilize the latest releases of affected SAML libraries. Please see the vendor list below for more information.

---

Vendor Information

475445

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Clever, Inc. __ Affected

Notified: January 24, 2018 Updated: February 26, 2018

Statement Date: February 24, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Both versions 1.x and 2.x versions are affected. A patch is available for both versions.

Duo Security __ Affected

Updated: February 28, 2018

Statement Date: December 19, 2017

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Duo Network Gateway (DNG) is affected and assigned CVE-2018-7340.

Vendor References

• <https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations&gt;
• <https://duo.com/labs/psa/duo-psa-2017-003&gt;

OmniAuth Affected

Notified: January 24, 2018 Updated: February 06, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

OneLogin Inc __ Affected

Notified: January 24, 2018 Updated: February 27, 2018

Statement Date: February 27, 2018

Status

Affected

Vendor Statement

Refer to the vendor's official notice.

Vendor Information

Refer to the vendor's official notice.

Vendor References

• <https://support.onelogin.com/hc/en-us/articles/360001271891&gt;

Addendum

Specific patch commits:

ruby-saml ``<https://github.com/onelogin/ruby-saml/releases/tag/v1.7.0>`` python-saml ``<https://github.com/onelogin/python-saml/releases/tag/v2.4.0>`` python3-saml ``<https://github.com/onelogin/python3-saml/releases/tag/v1.4.0>

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23475445 Feedback>).

Pulse Secure __ Affected

Updated: March 28, 2018

Status

Affected

Vendor Statement

| All Pulse Secure products were evaluated and the following products are known to be vulnerable by this issue:

* All supported versions of Pulse Connect Secure with SAML authentication server configured as Service Provider
* Pulse WorkSpace with SAML enabled
* Pulse One with Enterprise (SAML) SSO enabled on the admin login
* vTM 17.4 (Only) with a virtual server configured for SAML authentication.

For a list of supported software versions, please refer to our EOL policy. All other Pulse Secure products (not listed above) were determined as not vulnerable.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43667/&gt;

Shibboleth Consortium Affected

Notified: January 24, 2018 Updated: March 14, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://shibboleth.net/community/advisories/secadv_20180227.txt&gt;

Wizkunde B.V. __ Affected

Updated: April 05, 2018

Statement Date: April 03, 2018

Status

Affected

Vendor Statement

`We’ve got notified about this bug on Monday 3-4-2018 and immediately took actions to fix the ability to exploit this at implementations of our library.

The patch is written in this commit:
[https://github.com/Wizkunde/SAMLBase/commit/482cdf8c090e0f1179073034ebcb609ac7c3f5b3`](<https://github.com/Wizkunde/SAMLBase/commit/482cdf8c090e0f1179073034ebcb609ac7c3f5b3&gt;)

Vendor Information

Wizkunde SAMLBase prior to version 1.2.7 is affected, the issue was addressed in version 1.2.7. CVE-2018-5387 has been assigned.

Vendor References

• <https://github.com/Wizkunde/SAMLBase/issues/3&gt;
• <https://github.com/Wizkunde/SAMLBase/commit/482cdf8c090e0f1179073034ebcb609ac7c3f5b3&gt;

AssureBridge __ Not Affected

Updated: February 27, 2018

Statement Date: February 27, 2018

Status

Not Affected

Vendor Statement

We have tested against the vulnerability and determined that our SAML SSO product is not affected.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Box __ Not Affected

Notified: February 23, 2018 Updated: February 28, 2018

Statement Date: February 27, 2018

Status

Not Affected

Vendor Statement

Box is not affected by VU#475445 and has provided guidance to customers on our community site here: https://community.box.com/t5/Box-Product-News/Recently-reported-SAML-vulnerabilities-What-you-need-to-know-as/ba-p/52403

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://community.box.com/t5/Box-Product-News/Recently-reported-SAML-vulnerabilities-What-you-need-to-know-as/ba-p/52403&gt;

CA Technologies __ Not Affected

Updated: March 07, 2018

Statement Date: March 06, 2018

Status

Not Affected

Vendor Statement

“The results of testing have concluded that CA Single Sign-On, and the previously named CA Federation, is not affected by this vulnerability.”

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://support.ca.com/us/product-content/status/announcement-documents/2018/ca---proactive-notification---smplc---advisory---asmplc-100601.html&gt;

Cisco __ Not Affected

Notified: February 23, 2018 Updated: June 05, 2018

Statement Date: March 01, 2018

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Cisco AnyConnect and ASA and FTD software are not vulnerable.

ComponentSpace Pty Ltd __ Not Affected

Updated: February 28, 2018

Statement Date: February 28, 2018

Status

Not Affected

Vendor Statement

We have tested for this vulnerability and have determined that none of our SAML products are affected.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Entr’ouvert __ Not Affected

Notified: January 24, 2018 Updated: February 28, 2018

Statement Date: February 28, 2018

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Entr’ouvert develops the lasso C library that implements SAML2. Entr’ouvert has determined lasso is not affected by this vulnerability.

ForgeRock __ Not Affected

Updated: March 07, 2018

Statement Date: March 07, 2018

Status

Not Affected

Vendor Statement

“ForgeRock has carefully assessed our implementations of SAML 1.x, SAML2, OAuth2 SAML2 Grant, WS-Federation and the Java Fedlet, and determined that we are not affected by this vulnerability.”

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://backstage.forgerock.com/knowledge/kb/article/a44883924&gt;

GitHub __ Not Affected

Notified: January 24, 2018 Updated: March 01, 2018

Statement Date: February 28, 2018

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Neither GitHub nor GitHub Enterprise are affected by this vulnerability.

Google __ Not Affected

Notified: February 23, 2018 Updated: March 01, 2018

Statement Date: February 28, 2018

Status

Not Affected

Vendor Statement

Google Cloud / G Suite’s SAML single sign-on for managed Google accounts using third party Identity Providers<https://support.google.com/a/answer/60224> is not affected by this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Microsoft __ Not Affected

Notified: February 23, 2018 Updated: March 02, 2018

Statement Date: March 02, 2018

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Microsoft Azure Active Directory (AAS) and Microsoft Windows Server Active Directory Federation Services (ADFS) are not affected.

Okta Inc. __ Not Affected

Notified: January 29, 2018 Updated: February 27, 2018

Statement Date: February 15, 2018

Status

Not Affected

Vendor Statement

Okta was made aware of the vulnerability before the public disclosure and immediately undertook a thorough code review and patched. Okta is not vulnerable, and we don’t have any indication that the vulnerability was exploited in our systems.

Vendor Information

Okta is the leading independent provider of identity for the enterprise. The Okta Identity Cloud enables organizations to secure and manage their extended enterprise and transform their customers’ experiences. With over 5,000 pre-built integrations to applications, infrastructure and devices, Okta customers can easily and securely adopt the technologies they need to fulfill their missions.

Vendor References

• <https://www.okta.com/blog/2018/02/what-you-need-to-know-about-saml-vulnerability-research/&gt;

Ping Identity __ Not Affected

Updated: February 28, 2018

Statement Date: February 28, 2018

Status

Not Affected

Vendor Statement

Ping Identity products (PingFederate, PingOne) have been verified and found to be Not Affected by VU#475445.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Pivotal Software, Inc. __ Not Affected

Notified: January 24, 2018 Updated: February 28, 2018

Statement Date: February 28, 2018

Status

Not Affected

Vendor Statement

The Pivotal, Spring and Cloud Foundry teams have determined that the UAA project and Spring Security SAML are not exposed to this vulnerability and therefore does not require any upgrades.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://www.pivotal.io/security/vu475445&gt;
• <https://www.cloudfoundry.org/blog/vu475445&gt;

SAML (golang) Not Affected

Notified: March 16, 2018 Updated: March 19, 2018

Statement Date: March 19, 2018

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://github.com/crewjam/saml/pull/140&gt;

Tools4Ever __ Not Affected

Updated: May 18, 2018

Statement Date: May 16, 2018

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Tools4ever utilizes an unaffected SAML library.

VMware __ Not Affected

Updated: March 07, 2018

Statement Date: March 06, 2018

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The following products have been determined to be unaffected: נVMware vCenter Server נVMware Identity Manager נVMware Cloud Director

Vendor References

• <https://kb.vmware.com/s/article/53040&gt;

Danish e-Infrastructure Cooperation (WAYF) Unknown

Notified: January 24, 2018 Updated: January 24, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

GitLab Inc. Unknown

Notified: March 02, 2018 Updated: March 02, 2018

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor References

SSO Easy __ Unknown

Updated: March 02, 2018

Statement Date: March 02, 2018

Status

Unknown

Vendor Statement

We have tested for this vulnerability and have determined that the SAML functionality and processing is not affected by VU#475445.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

View all 26 vendors __View less vendors __

CVSS Metrics

Group	Score	Vector
Base	6.3	AV:N/AC:M/Au:S/C:C/I:N/A:N
Temporal	4.9	E:POC/RL:OF/RC:C
Environmental	4.9	CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

• <https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations&gt;
• <https://duo.com/labs/psa/duo-psa-2017-003&gt;
• <https://cwe.mitre.org/data/definitions/287.html&gt;

Acknowledgements

Thanks to Kelby Ludwig of Duo Security for reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

CVE IDs:	CVE-2017-11427, CVE-2017-11428, CVE-2017-11429, CVE-2017-11430, CVE-2018-0489, CVE-2018-5387
Date Public:	2018-02-27 Date First Published: