Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SAML: A fractal of bad design

blog.trailofbits.com | blog | #authentication | #sso | #xml | #protocol-design | #saml | #openid-connect | #signature-wrapping

Summary

Trail of Bits traces SAML's committee-driven origins and argues the 2002 XML-based SSO protocol should finally be retired: cursed XML signature validation keeps producing vulnerabilities, and OIDC is the way forward.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Attacking SSO: Common SAML Vulnerabilities and Ways to Find Them
A practical guide to testing SSO solutions that use SAML, covering the IdP/SP message flow and common implementation mistakes involving signatures, assertions, and message expiration.
research · portswigger.net
SAML roulette: the hacker always wins
Chaining XML round-trip attacks and namespace confusion yields unauthenticated admin access on GitLab Enterprise via ruby-saml, using comment and CDATA mutations that defeat signature verification.
blog · blog.trailofbits.com
Unexpected security footguns in Go's parsers
Unexpected behaviors in Go's JSON, XML, and YAML parsers let attackers bypass authentication, evade authorization, and exfiltrate data—seen in HashiCorp Vault's CVE-2020-16250 and real engagements.
blog · blog.trailofbits.com
Cryptographic design review of Ockam
Trail of Bits reviewed Ockam's protocol design for end-to-end encrypted channels, examining its Noise XX-based secure channels and applying formal verification with Verifpal and CryptoVerif.
blog · blog.trailofbits.com
Security flaws in an SSO plugin for Caddy
Trail of Bits identified 10 vulnerabilities in Caddy's caddy-security SSO plugin, enabling reflected XSS, OAuth replay, 2FA brute-force bypass, open redirection, and unauthorized access.
blog · blog.trailofbits.com
Graphtage: A New Semantic Diffing Tool
Graphtage is a semantic diff tool for tree-structured files such as JSON, XML, and YAML: unlike line-oriented diff, it matches unordered structures and even compares across formats.
back