GHSA-rrfw-hg9m-j47h Signature Validation Bypass
An authentication bypass in the goxmldsig library allows attackers to forge SAML assertions, potentially leading to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-rrfw-hg9m-j47h?
GHSA-rrfw-hg9m-j47h is an authentication bypass vulnerability in github.com/russellhaering/goxmldsig, published on 24 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
An authentication bypass exists in the goxmldsig this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.
Patches
Version 0.4.2 bumps the dependency which should fix the issue.
For more information
Please see the advisory in goxmldsig
Credits
The original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.
Which versions are affected by GHSA-rrfw-hg9m-j47h?
2 open source packages ship an affected version, including github.com/russellhaering/goxmldsig.
| Package | Affected | Fixed in |
|---|---|---|
github.com/russellhaering/goxmldsig Go | All versions | 0.4.2 |
github.com/russellhaering/goxmldsig Go | All versions | 0.4.2 |
How do I fix GHSA-rrfw-hg9m-j47h?
Upgrade github.com/russellhaering/goxmldsig to 0.4.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-rrfw-hg9m-j47h being exploited?
There is no known exploitation of GHSA-rrfw-hg9m-j47h in the wild and no public exploit code.