Crypt-Server icon indicating copy to clipboard operation
Crypt-Server copied to clipboard
verified publisher icon grahamgilbert

Cross Site Scripting Vulnerability in SAML Auth Flow

Open tylerwhardy opened this issue 1 year ago • 3 comments

In the saml2/login endpoint when using 3rd party SSO, the idp parameter is vulnerable to cross-site scripting injection due to insufficient input sanitization.

Proof of Concept: Visit the URL endpoint crypt.domain.com/saml2/login/?idp=<%2fscript><svg/onload=alert(origin)>

This will result in a XSS popup message indicating the attack worked.

This could be combined with data exfiltration Javascript or similar mechanisms to steal user data or session information.

tylerwhardy avatar Sep 26 '24 15:09 tylerwhardy

The saml library we use is a third party one. Do you have any suggestions on how to remediate this?

grahamgilbert avatar Sep 26 '24 15:09 grahamgilbert

It looks like it was fixed in the lib on this commit:

https://github.com/IdentityPython/djangosaml2/commit/b8399c90d0c4ccbb64f626e6b1892d29974282ce

Can you update to latest release for djangosaml2?

tylerwhardy avatar Sep 26 '24 17:09 tylerwhardy

Pull requests happily accepted

grahamgilbert avatar Sep 27 '24 04:09 grahamgilbert