Entr'ouvert Lasso Type Confusion Vulnerability in SAML Response Processing Allowing Arbitrary Code Execution

A type confusion vulnerability has been identified in Entr'ouvert Lasso versions 2.5.1 and 2.8.2. The issue arises in the 'lasso_node_impl_init_from_xml' function, where a specially crafted SAML response can lead to arbitrary code execution. This vulnerability is triggered when an attacker sends a malformed SAML response, causing the application to misinterpret data types and execute unintended code.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Entr'ouvert Lasso is running.

Reproduction

To reproduce this vulnerability, send a malformed SAML response to an application using Entr'ouvert Lasso 2.5.1 or 2.8.2. The response should be crafted to exploit the type confusion in the 'lasso_node_impl_init_from_xml' function, which will cause the application to execute arbitrary code.

Remediation

Users can upgrade to the latest version of Entr'ouvert Lasso to address this vulnerability.