Secure SAML validation to prevent XML signature wrapping attacks
This addresses security vulnerabilities in SAML implementations for identity management systems, but it is incremental as it builds on prior demonstrations of such attacks.
The paper tackled the problem of XML signature wrapping attacks in SAML validation by showing how poor library documentation leads to vulnerable code, and it provided guidance to avoid these issues.
SAML assertions are becoming popular method for passing authentication and authorisation information between identity providers and consumers using various single sign-on protocols. However their practical security strongly depends on correct implementation, especially on the consumer side. Somorovsky and others have demonstrated a number of XML signature related vulnerabilities in SAML assertion validation frameworks. This article demonstrates how bad library documentation and examples can lead to vulnerable consumer code and how this can be avoided.