Signature-Validation Bypass in SimpleSAMLphp by SimpleSAMLphp

CVE-2017-18122

What is CVE-2017-18122?

A signature-validation bypass vulnerability exists in SimpleSAMLphp versions up to 1.14.16. When using SAML 1.1, this flaw allows a malicious actor to bypass proper signature validation for unsigned SAML responses. If a SAML response includes multiple signed assertions, only one valid signature is necessary for the response to be deemed legitimate. As a result, an attacker can impersonate any user from any Identity Provider (IdP) when presented with a single valid assertion. This poses significant security risks, as attributes from all received assertions are merged, and the entityID taken from the first assertion can lead to unauthorized access.

References