CVE-2017-11427: OneLogin PythonSAML XML Signature Wrapping Vulnerability
Summary
CVE-2017-11427: OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cry... Affects python-saml versions < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OneLogin PythonSAML is a Python library that provides SAML support for Python applications. It allows developers to implement SAML-based Single Sign-On (SSO) functionality in their applications. The library handles the creation and verification of SAML messages, including XML signatures. However, versions 2.3.0 and earlier of OneLogin PythonSAML may incorrectly utilize XML DOM traversal and canonicalization APIs, which can lead to an XML Signature Wrapping vulnerability. This vulnerability allows an attacker to manipulate SAML data without invalidating the cryptographic signature, potentially bypassing authentication to SAML service providers.
Vulnerability Detail
The XML Signature Wrapping vulnerability in OneLogin PythonSAML arises from the incorrect usage of XML DOM traversal and canonicalization APIs. By manipulating the SAML data, an attacker can modify the content of the SAML message without invalidating the cryptographic signature. This manipulation can lead to unauthorized access to SAML service providers, bypassing authentication mechanisms. The vulnerability affects versions 2.3.0 and earlier of the python-saml package available on PyPI.
How To Fix
Minimum fixed version
2.4.0
This is the first release that contains the fix.
pip install --upgrade "python-saml==2.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The XML Signature Wrapping vulnerability in OneLogin PythonSAML can potentially allow an attacker to bypass authentication to SAML service providers. It is crucial to upgrade to version 2.4.0 or later of the python-saml package to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for python-saml →
FAQ
The vulnerability allows an attacker to manipulate SAML data without invalidating the cryptographic signature, potentially bypassing authentication to SAML service providers.
Versions 2.3.0 and earlier of the python-saml package are affected.
To fix this vulnerability, upgrade to version 2.4.0 or later of the python-saml package.
No specific workarounds are mentioned for this vulnerability.
More information about this vulnerability can be found in the advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/python-saml/PYSEC-2019-198.yaml
