Horizon Alert
Summary of the vulnerability and why it matters
This advisory addresses a critical vulnerability in how certain Perl applications handle encrypted identity information. The issue allows an unauthenticated party to bypass standard security checks and potentially impersonate any user by crafting specially manipulated data. This could impact services that rely on this specific Perl module for secure user authentication.
- Bypass user verification in identity systems.
- Impacts public-facing authentication services.
- Confirm relevance and verify affected systems.
Attack Path
How an attacker could exploit the issue
An attacker can impersonate any user by sending a specially crafted SAML assertion to a vulnerable service. The attacker starts by obtaining the Service Provider's (SP) encryption certificate from its public metadata. They then create an unsigned SAML assertion, encrypt it using the SP's certificate, and send it to the SP's assertion consumer service. If the SP's SAML library is configured to accept encrypted assertions without proper signature verification, the attacker can bypass authentication and assume the identity of any user.
- Requires network access to the service.
- Unsigned, encrypted assertion triggers bypass.
- Risk of arbitrary user impersonation.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated party to bypass authentication and impersonate any user when an affected service is configured to decrypt encrypted SAML assertions. This occurs because the system fails to verify the signature on decrypted assertions under certain conditions, enabling the acceptance of unverified identity information.
- User identities and associated attributes.
- Decryption of unsigned assertions.
- Unauthorized access as any user.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability impacts systems configured to accept and decrypt SAML `EncryptedAssertions` without a signature. Application owners responsible for SAML integrations and infrastructure teams managing identity services should investigate their `Net::SAML2` deployments. The immediate first step is to identify all instances of `Net::SAML2` that are configured with a decryption key file, assess their exposure and criticality, and then plan for remediation or mitigation.
- Own the SAML integration.
- Verify decryption key file usage.
- Plan remediation based on risk.
