RobotsAndPencils go-saml up to 0.0.0-20230606195814-29020529affc improper authentication

Summaryinfo

A vulnerability was found in RobotsAndPencils go-saml up to 0.0.0-20230606195814-29020529affc. It has been classified as critical. This affects an unknown function. This manipulation causes improper authentication. This vulnerability is tracked as CVE-2023-48703. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in RobotsAndPencils go-saml up to 0.0.0-20230606195814-29020529affc. It has been declared as critical. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the `xmlsec1` command line tool is called internally to verify the signature of SAML assertions. When `xmlsec1` is used without defining the enabled key data, the origin of the public key for the signature verification is, unfortunately, not restricted. That means an attacker can sign the SAML assertions themselves and provide the required public key (e.g. an RSA key) directly embedded in the SAML token. Projects still using RobotsAndPencils/go-saml should move to another SAML library or alternatively remove support for SAML from their projects. The vulnerability can likely temporarily be fixed by forking the go-saml project and adding the command line argument `--enabled-key-data` and specifying a value such as `x509` or `raw-x509-cert` when calling the `xmlsec1` binary in the verify function. Please note that this workaround must be carefully tested before it can be used.

The weakness was disclosed 03/06/2024 as GHSL-2023-121. It is possible to read the advisory at securitylab.github.com. This vulnerability is known as CVE-2023-48703 since 11/17/2023. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• RobotsAndPencils

Name

• go-saml

Version

• 0.0.0-20230606195814-29020529affc

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion