Wrapped
SAML XML Signature Wrapping (XSW) — insane difficulty
Scenario
This app is a SAML Service Provider. The Identity Provider signs SAML
assertions with an HMAC. The SP verifies the signature, then calls
root.find('.//{ns}NameID') to get the authenticated username.
That XPath finds the first NameID in document order — not necessarily the one inside the signed assertion. Insert a rogue assertion before the signed one and the SP will authenticate you as whoever you claim while still considering the signature valid.
Steps
- Click Get SAML Response to obtain a
signed response for
user@example.com. - Decode the base64+zlib payload, inspect the XML.
- Insert a new
<saml:Assertion>with<saml:NameID>admin</saml:NameID>before the existing signed assertion. - Re-encode and submit to
POST /acs.