Description (CNA)
Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcement, or replay detection anywhere in the SAML SP code path. As a result, an attacker can replay a previously captured SAML assertion to obtain an authenticated session for the assertion’s subject, including administrator accounts, without needing the user’s password or MFA credentials.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Casdoor / Casdoor | affected 0 through 2.362.0 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.