Description (CNA)
Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue. This issue affects samly: from 0.3.0 onward.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| dropbox / samly | affected 0.3.0 before * |
| dropbox / samly | affected 8a5bb1b4a4753d05470da2036323477f63cfdf4c before * |
| handnot2 / samly | affected 8a5bb1b4a4753d05470da2036323477f63cfdf4c before * |
CWE
CWE-345
References
ADP enrichment
No English description supplied.
No references supplied.