SAML is often the trust anchor for Single Sign-On (SSO) in most modern day organizations. This presentation will discuss a new vulnerability discovered which has affected multiple independent SAML implementations, and more generally, can affect any systems reliant on the security of XML signatures. The issues found through this research affected multiple libraries, which in turn may underpin many SSO systems.
The root cause of this issue is due to the way various SAML implementations traverse the XML DOM after validating signatures. These vulnerabilities allow an attacker to tamper with signed XML documents, modifying attributes such as an authenticating user, without invalidating the signatures over these attributes. In many cases, this allows an attacker with authenticated access to a SAML IdentityProvider to access services as an entirely different user - and more easily than you'd expect.
This talk will also discuss another demonstrated class of vulnerabilities in user directories that amplify the impact of the previously mentioned vulnerability, and in some cases, can enable authentication bypasses on their own.
Kelby Ludwig is a senior AppSec Engineer at Duo Security. Kelby specializes in secure code review, web application testing, cryptography, and low-friction methods of shipping secure software. Prior to Duo, Kelby was a AppSec Engineer at Praetorian finding vulnerabilities within software produced by Fortune 500 companies and venture-backed startups. Kelby holds a BS in Computer Science from the University of Texas at Austin.