Novel SAML Authentication Bypasses Exploit XML Parser Inconsistencies
PortSwigger researcher Zakhar Fedotkin has published findings detailing novel methods to achieve full authentication bypass in Ruby and PHP SAML ecosystems. The research, titled 'The Fragile Lock,' exposes critical vulnerabilities stemming from parser-level inconsistencies, including attribute pollution, namespace confusion, and a newly identified technique called Void Canonicalization. These flaws allow attackers to completely bypass XML Signature validation while presenting seemingly valid SAML documents to applications. Unlike traditional XML Signature Wrapping attacks that require stealing legitimate assertions, this approach exploits discrepancies between signature verification modules and SAML processing logic. By reusing any XML document signed with an Identity Provider’s private key, attackers can inject malicious assertions that are accepted by the Service Provider. The study includes a demonstration on a vulnerable GitLab EE instance and introduces an open-source toolkit for identifying parser discrepancies. This highlights persistent security risks in SAML 2.0 due to its reliance on outdated XML technology, urging the security community to address these foundational issues through coordinated efforts rather than temporary fixes.
Wire timeline
Novel SAML Authentication Bypasses Exploit XML Parser Inconsistencies
PortSwigger researcher Zakhar Fedotkin has published findings detailing novel methods to achieve full authentication bypass in Ruby and PHP SAML ecosystems. The research, titled 'The Fragile Lock,' exposes critical vulnerabilities stemming from parser-level inconsistencies, including attribute pollution, namespace confusion, and a newly identified technique called Void Canonicalization. These flaws allow attackers to completely bypass XML Signature validation while presenting seemingly valid SAML documents to applications. Unlike traditional XML Signature Wrapping attacks that require stealing legitimate assertions, this approach exploits discrepancies between signature verification modules and SAML processing logic. By reusing any XML document signed with an Identity Provider’s private key, attackers can inject malicious assertions that are accepted by the Service Provider. The study includes a demonstration on a vulnerable GitLab EE instance and introduces an open-source toolkit for identifying parser discrepancies. This highlights persistent security risks in SAML 2.0 due to its reliance on outdated XML technology, urging the security community to address these foundational issues through coordinated efforts rather than temporary fixes.
PortSwigger Research