CVE-2023-48703: RobotsAndPencils go-saml Authentication Bypass Vulnerability

Background

RobotsAndPencils go-saml is a SAML client library written in Go. It provides functionality for SAML authentication and assertion verification. The library is widely used in projects that require SAML support. However, all known versions of go-saml are vulnerable to an authentication bypass vulnerability.

Vulnerability Detail

The vulnerability in go-saml is due to the insecure usage of the xmlsec1 command line tool for verifying the signature of SAML assertions. When xmlsec1 is called without defining the enabled key data, the origin of the public key used for signature verification is not restricted. This allows an attacker to sign SAML assertions themselves and provide a malicious public key embedded in the SAML token. As a result, the attacker can bypass the authentication process and gain unauthorized access to the system. The impact of this vulnerability can be significant, as it compromises the integrity and security of SAML-based authentication.

Workaround

A possible workaround for this vulnerability is to modify the go-saml library by adding the --enabled-key-data command line argument when calling the xmlsec1 binary in the verify function. Here is an example of how the code can be modified:

def verifySignature(xml string) bool {
    // Add the --enabled-key-data argument
    cmd := exec.Command("xmlsec1", "--enabled-key-data", "x509", "--verify", "--pubkey-cert-pem", "public_key.pem")
    cmd.Stdin = strings.NewReader(xml)
    output, err := cmd.CombinedOutput()
    if err != nil {
        log.Fatal(err)
    }
    // Process the output and return the verification result
}

Please note that this workaround should be carefully implemented and tested.

Conclusion

The RobotsAndPencils go-saml library is vulnerable to an authentication bypass issue, allowing attackers to bypass SAML authentication and gain unauthorized access. It is recommended to migrate to another SAML library or apply the provided workaround to mitigate this vulnerability.

See every vulnerability recorded for github.com/RobotsAndPencils/go-saml →

FAQ