security runtime_error ai_generated true

SAML response parsing vulnerable to XXE allowing arbitrary file read

ID: security/saml-xml-external-entity-xxe

Also available as: JSON · Markdown · 中文
90%Fix Rate
84%Confidence
1Evidence
2023-12-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Shibboleth 3.4 active — — —
OpenSAML 4.2 active — — —
SimpleSAMLphp 1.19 active — — —

Root Cause

The XML parser used to process SAML assertions is configured with external entity resolution enabled, allowing an attacker to inject a malicious DOCTYPE that reads local files or performs SSRF.

generic

中文

用于处理SAML断言的XML解析器配置为启用外部实体解析，允许攻击者注入恶意DOCTYPE来读取本地文件或执行SSRF。

Official Documentation

https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing

Workarounds

  1. 95% success Explicitly disable external entities in the XML parser. In Java with DocumentBuilderFactory: factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); 
    Explicitly disable external entities in the XML parser. In Java with DocumentBuilderFactory: factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
  2. 90% success Use a secure XML parser that rejects DTDs by default, such as the one provided by OWASP's XML Security library. 
    Use a secure XML parser that rejects DTDs by default, such as the one provided by OWASP's XML Security library.
  3. 85% success Validate the SAML response against an XSD schema before parsing, and reject any document that contains a DOCTYPE declaration. 
    Validate the SAML response against an XSD schema before parsing, and reject any document that contains a DOCTYPE declaration.

中文步骤

  1. 在XML解析器中显式禁用外部实体。在Java中使用DocumentBuilderFactory：factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
  2. 使用默认拒绝DTD的安全XML解析器，例如OWASP XML安全库提供的解析器。
  3. 在解析之前，根据XSD模式验证SAML响应，并拒绝任何包含DOCTYPE声明的文档。

Dead Ends

Common approaches that don't work:

  1. 40% fail

    Disabling DTD processing globally may break legitimate SAML responses that use DTDs for signature validation.

  2. 70% fail

    Using a regex to filter out DOCTYPE declarations is unreliable and can be bypassed with encoding tricks.

  3. 50% fail

    Upgrading the SAML library without checking its XML parser configuration may not fix the issue if the library uses a vulnerable parser by default.