CVE-2017-11427-DEMO

Basic Environment

$ sudo apt-get install libxml2-dev libxslt1-dev
$ sudo apt-get install libxml2-dev libxmlsec1-dev libxmlsec1-openssl

DEMO:

$ git clone https://github.com/CHYbeta/CVE-2017-11427-DEMO.git
$ cd CVE-2017-11427-DEMO
$ source venv/bin/active
$ cd vuln_saml
$ python index.py

Accounts:

username: user_evil
password: iamuser1
email: [email protected]

username: user_normal
password: iamuser2
email: [email protected]

Analysis

Vulnerability Analysis and Practice: SAML-Based Single Sign-On System

Attack

First, log in as user_evil. Use Burp to intercept the SAMLResponse field value.

Select Action -> Send to Repeater to prepare for subsequent steps.

Then Forward to allow user_evil to authenticate successfully.

First URL-decode the SAMLResponse field value, then remove newline characters, and finally Base64-decode it. In the decoded XML, modify emailAddress and Attribute to [email protected]<!-- -->.evil, i.e., insert a comment between the original authenticated user's email [email protected].

Then Base64-encode the modified XML, followed by URL-encoding, and replace the original SAMLResponse value to obtain a new session.

Use this new session to log in:

user.email has now become [email protected], and user user_normal is logged in successfully.

Notes

• This environment is intended solely for testing and technical exchange. Do not use it for illegal purposes.
• When registering with oneLogin, email validity was not verified, so the provided accounts do not involve personal information. Users of this DEMO are also kindly requested not to attempt to change passwords. Thank you.