CVE-2021-21238: SAML XML Signature wrapping in PySAML2
Summary
CVE-2021-21238: SAML XML Signature wrapping in PySAML2. Affects pysaml2 versions < 6.5.0. Fixed in 6.5.0. How to fix ↓
Also tracked for
- python-pysaml2 · Debian:11
The same CVE-2021-21238 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PySAML2 is an open-source Python library that provides support for SAML (Security Assertion Markup Language) authentication and federation. It is commonly used in identity and access management systems to enable single sign-on and secure communication between service providers and identity providers. PySAML2 utilizes the default CryptoBackendXmlSec1 backend for verifying signed SAML documents. However, versions up to 6.4.1 do not validate the SAML document against an XML schema, which allows for the possibility of XML Signature wrapping attacks. These attacks involve presenting elements with a valid signature inside elements that have been malformed, tricking the verification process. The verification is performed by xmlsec1, which only validates the first signature it finds in the given scope, rather than all signatures in the document.
Vulnerability Detail
The vulnerability in PySAML2 versions up to 6.4.1 allows for XML Signature wrapping attacks. This means that an attacker can craft a malicious SAML document with valid signatures but containing malformed elements. When this document is processed by PySAML2, the verification process may be deceived into accepting the document as valid. This can lead to various security issues, such as unauthorized access, privilege escalation, and information disclosure. The impact of this vulnerability is dependent on the specific implementation and usage of PySAML2 in the affected system.
How To Fix
Minimum fixed version
6.5.0
This is the first release that contains the fix.
pip install --upgrade "pysaml2==6.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in PySAML2 versions up to 6.4.1 allows for XML Signature wrapping attacks, which can lead to various security issues. To mitigate this vulnerability, users should upgrade to PySAML2 version 6.5.0 or later. It is important to stay updated with security patches and follow best practices to ensure the integrity and security of identity and access management systems. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pysaml2 →
FAQ
PySAML2 is a Python library used for SAML authentication and federation. It enables secure communication between service providers and identity providers, facilitating single sign-on functionality.
XML Signature wrapping is an attack technique where a malicious XML document is crafted to contain valid signatures but with malformed elements. This can deceive the verification process into accepting the document as valid, leading to potential security vulnerabilities.
The impact of this vulnerability depends on the specific implementation and usage of PySAML2 in the affected system. It can potentially result in unauthorized access, privilege escalation, and information disclosure.
To fix this vulnerability, you should upgrade to PySAML2 version 6.5.0 or later. This updated version includes the necessary validation of SAML documents against an XML schema, preventing XML Signature wrapping attacks.
No workaround has been provided for this vulnerability. It is recommended to upgrade to the fixed version of PySAML2.
References
Related vulnerabilities
Recent vulnerabilities recorded for pysaml2.
