vendor:
MiniorangeSAML
by:
Cristian 'void' Giustini
8,8
CVSS
HIGH
Privilege Escalation
287
CWE
Product Name: MiniorangeSAML
Affected Version From: 8.x-2.22
Affected Version To: 8.x-2.22
Patch Exists: NO
Related CWE: N/A
CPE: a:drupal:drupal:8.x-2.22
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Linux Debian (PHP 8.0.7 with Apache/2.4.38)
2021
Drupal Module MiniorangeSAML 8.x-2.22 – Privilege escalation via XML Signature Wrapping
The MiniorangeSAML Drupal Plugin v. 8.x-2.22 is vulnerable to XML Signature Wrapping Attacks that could allows an attacker to perform privilege escalation attacks. In order to exploit the vulnerability, the plugin must be configured with the 'Either SAML reponse or SAML assertion must be signed' options enabled and an empty 'x509 certificate'. An attacker can register a normal user on the website, perform a login, intercept the request with Burp Suite and decode the SAMLResponse parameter, inject an additional <Saml:Assertion> object before the original one and send the modified request. The user will be logged in as an administrator.
Mitigation:
Disable the 'Either SAML reponse or SAML assertion must be signed' option and configure a valid 'x509 certificate'.
