security runtime_error ai_generated true

SAML响应解析易受XXE攻击，允许任意文件读取

SAML response parsing vulnerable to XXE allowing arbitrary file read

ID: security/saml-xml-external-entity-xxe

其他格式: JSON · Markdown 中文 · English
90%修复率
84%置信度
1证据数
2023-12-01首次发现

版本兼容性

版本状态引入弃用备注
Shibboleth 3.4 active — — —
OpenSAML 4.2 active — — —
SimpleSAMLphp 1.19 active — — —

根因分析

用于处理SAML断言的XML解析器配置为启用外部实体解析，允许攻击者注入恶意DOCTYPE来读取本地文件或执行SSRF。

English

The XML parser used to process SAML assertions is configured with external entity resolution enabled, allowing an attacker to inject a malicious DOCTYPE that reads local files or performs SSRF.

generic

官方文档

https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing

解决方案

  1. 在XML解析器中显式禁用外部实体。在Java中使用DocumentBuilderFactory：factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
  2. 使用默认拒绝DTD的安全XML解析器，例如OWASP XML安全库提供的解析器。
  3. 在解析之前，根据XSD模式验证SAML响应，并拒绝任何包含DOCTYPE声明的文档。

无效尝试

常见但无效的做法:

  1. 40% 失败

    Disabling DTD processing globally may break legitimate SAML responses that use DTDs for signature validation.

  2. 70% 失败

    Using a regex to filter out DOCTYPE declarations is unreliable and can be bypassed with encoding tricks.

  3. 50% 失败

    Upgrading the SAML library without checking its XML parser configuration may not fix the issue if the library uses a vulnerable parser by default.