[IT-SecNots] [Security-news] SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider - Moderately critical - Multiple vulnerabilities - SA-CONTRIB-2021-036

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2021-036

Project: SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider [1]
Date: 2021-September-22
Security risk: *Moderately critical* 14∕25
AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2]
Vulnerability: Multiple vulnerabilities

Description: 
This module provides a solution to authenticate visitors using existing SAML
providers.

Certain non-default configurations allow a malicious user to login as any
chosen user.

The vulnerability is mitigated by the module's default settings which require
the options "Either sign SAML assertions" and "x509 certificate".

Solution: 
Ensure that the "Either SAML response or SAML assertion must be signed" and
"x509 certificate" options on the dedicated plugin page are both enabled.

Install the latest version:

  * If you use the SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider
    module for Drupal 8.x or 9.x, upgrade to SAML SP 2.0 Single Sign On (SSO)
    - SAML Service Provider 8.x-2.24 [3]
  * If you use the SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider
    module for Drupal 7.x, upgrade to SAML SP 2.0 Single Sign On (SSO) - SAML
    Service Provider 7.x-2.57 [4]

Reported By: 
  * Cristian 'void' Giustini [5]

Fixed By: 
  * Cristian 'void' Giustini [6]
  * abhay19 [7]

Coordinated By: 
  * Damien McKenna [8] of the Drupal Security Team


[1] https://www.drupal.org/project/miniorange_saml
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/miniorange_saml/releases/8.x-2.24
[4] https://www.drupal.org/project/miniorange_saml/releases/7.x-2.60
[5] https://www.drupal.org/user/3680969
[6] https://www.drupal.org/user/3680969
[7] https://www.drupal.org/user/3549350
[8] https://www.drupal.org/u/damienmckenna

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news