Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Meet Silver SAML: Golden SAML in the Cloud

semperis.com | blog | #cloud | #vulnerability-research | #entra-id | #authentication | #saml | #golden-saml | #silver-saml | #certificate-abuse

Summary

Semperis researchers detail Silver SAML: a stolen Entra ID SAML signing certificate lets attackers forge authentication responses to apps like Salesforce—no AD FS needed. Risks and defenses covered.
Published
Collected

original ↗

Related coverage

blog · blog.trailofbits.com
SAML: A fractal of bad design
Trail of Bits traces SAML's committee-driven origins and argues the 2002 XML-based SSO protocol should finally be retired: cursed XML signature validation keeps producing vulnerabilities, and OIDC is the way forward.
blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
blog · netspi.com
Attacking SSO: Common SAML Vulnerabilities and Ways to Find Them
A practical guide to testing SSO solutions that use SAML, covering the IdP/SP message flow and common implementation mistakes involving signatures, assertions, and message expiration.
vulnerability · projectzero.google
[CVE-2020-16250] Enter the Vault: Authentication Issues in HashiCorp Vault
In this blog post I'll discuss two vulnerabilities in HashiCorp Vault and its integration with Amazon Web Services (AWS) and Google Cloud Platform (GCP). These issues can lead to an authentication bypass in configurations that use the aws and gcp auth methods, and demonstrate the type of issues you can find in modern “cloud-native” software. Both vulnerabilities (CVE-2020-16250/16251) were addressed by HashiCorp and are fixed in Vault versions 1.2.5, 1.3.8, 1.4.4 and 1.5.1 released in August.
blog · semperis.com
What is Identity Attack Surface Management?
This guide to identity attack surface management explains why AD, Entra ID, and Okta deserve priority in ASM programs, plus key strategies, tooling, and steps for implementation.
blog · semperis.com
Microsoft Entra Connect Compromise Explained
If attackers seize the Entra Connect server, the ADSync account and PTA agents open a path from on-prem AD to the cloud. The post shows AADInternals-based credential theft and hardening tips.
back