CVE-2020-15216: XML Digital Signature Validation Bypass in github.com/dexidp/dex/connector/saml
Summary
GO-2021-0056: Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed. Affects github.com/dexidp/dex/connector/saml versions < 0.0.0-20201214082111-324b1c886b40. Fixed in 0.0.0-20201214082111-324b1c886b40. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/dexidp/dex/connector/saml package is a component of the Dex identity service that provides a SAML connector for authentication and authorization. It allows users to authenticate and authorize access to applications using SAML-based identity providers. The package implements XML Digital Signature validation to ensure the integrity and authenticity of SAML documents.
Vulnerability Detail
Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed. This vulnerability can be exploited by an attacker to tamper with SAML documents and impersonate authenticated users or gain unauthorized access to applications.
How To Fix
Minimum fixed version
0.0.0-20201214082111-324b1c886b40
This is the first release that contains the fix.
go get github.com/dexidp/dex/connector/saml@v0.0.0-20201214082111-324b1c886b40Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the fixed version as soon as possible.
Conclusion
The github.com/dexidp/dex/connector/saml package is vulnerable to a bypass of XML Digital Signature validation, which can lead to unauthorized access or impersonation. It is crucial to update the package to the fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/dexidp/dex/connector/saml →
FAQ
This vulnerability allows an attacker to bypass XML Digital Signature validation, potentially leading to unauthorized access to applications or impersonation of authenticated users.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file and Vulert will analyze it for open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to update the package to the fixed version to mitigate the risk.
Yes, this vulnerability is identified as CVE-2020-15216.
Yes, you can find more information about this vulnerability in the Open Source Vulnerability database at https://vuln.go.dev/ID/GO-2021-0056.json.
