SimpleSAMLphp SAML2 Library Signature Confusion Vulnerability in HTTP-Redirect Binding

A signature confusion vulnerability has been identified in the SimpleSAMLphp SAML2 library, affecting versions prior to 4.17.0 and 5.0.0-alpha.20. The issue arises in the HTTP-Redirect binding, where an attacker can manipulate signed SAML responses to trick the application into accepting unsigned messages. This vulnerability could be exploited to impersonate users by exploiting the way SAML requests and responses are processed and verified.

Impact

Exploitation of this vulnerability allows for a signature confusion attack, where an unsigned SAML message is accepted as valid. This could lead to impersonation of users within the service provider.

Reproduction

To reproduce this vulnerability, send a SAML response via the HTTP-Redirect binding that is signed. Include an unsigned SAML request parameter. The application will accept the unsigned request while verifying the signature of the response, creating a confusion that can be exploited.

Remediation

Users should upgrade to SimpleSAMLphp versions 4.17.0 or 5.0.0-alpha.20, where this vulnerability has been fixed.