SAML_SIGNATURE_WRAPPING security protocol_error ai_generated true

SAML XML signature wrapping attack: attacker injects malicious assertions that bypass signature validation

ID: security/saml-xml-signature-wrapping-bypass

Also available as: JSON · Markdown · 中文
85%Fix Rate
87%Confidence
1Evidence
2023-08-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
OpenSAML 4.3.0 active — — —
Shibboleth IdP 4.3.0 active — — —
SimpleSAMLphp 1.19.0 active — — —
Microsoft AD FS 2019 active — — —
Okta SAML 1.0.0 active — — —

Root Cause

SAML response parser validates the signature on the original assertion but processes a different, unsigned assertion injected via XML wrapping (e.g., using ID duplication or SOAP envelope manipulation), allowing attacker-controlled attributes.

generic

中文

SAML 响应解析器验证原始断言的签名，但处理通过 XML 包装（例如使用 ID 重复或 SOAP 信封操作）注入的未签名断言，从而允许攻击者控制的属性。

Official Documentation

https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf

Workarounds

  1. 90% success Enforce strict assertion ID uniqueness and reject responses with duplicate IDs. Example in Java using OpenSAML: set `strictValidation=true` and configure `IdAttributeResolver` to check for duplicates. 
    Enforce strict assertion ID uniqueness and reject responses with duplicate IDs. Example in Java using OpenSAML: set `strictValidation=true` and configure `IdAttributeResolver` to check for duplicates.
  2. 85% success Use a whitelist of allowed assertion IDs or require that the signed assertion is the only one processed, ignoring any wrapped content. 
    Use a whitelist of allowed assertion IDs or require that the signed assertion is the only one processed, ignoring any wrapped content.

中文步骤

  1. Enforce strict assertion ID uniqueness and reject responses with duplicate IDs. Example in Java using OpenSAML: set `strictValidation=true` and configure `IdAttributeResolver` to check for duplicates.
  2. Use a whitelist of allowed assertion IDs or require that the signed assertion is the only one processed, ignoring any wrapped content.

Dead Ends

Common approaches that don't work:

  1. 85% fail

    Attackers can place the malicious assertion before the signed one; parser may process the first unsigned assertion.

  2. 75% fail

    Wrapping attacks use well-formed XML that passes schema validation; the attack is structural, not syntactic.

  3. 80% fail

    Attackers can sign the malicious assertion with a stolen or self-signed certificate if the trust store is misconfigured.