GHSA-rpj7-hr7h-w6p9
CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| NuGet | CoreWCF.Primitives | < 1.8.1 | 1.8.1 |
| NuGet | CoreWCF.Primitives | >= 1.9.0, < 1.9.1 | 1.9.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
When a service is configured to validate SAML tokens using a method other than X.509 certificate signing, the final signature verification is skipped.
#### Preconditions
The service is configured to authenticate using SAML tokens and an out of band token resolver (commonly the IssuerTokenResolver of IssuedTokenServiceCredential) holds a non-X.509 SecurityToken whose key identifier the attacker can reference in the assertion’s `<KeyInfo>` - for example a `BinarySecretSecurityToken` representing the symmetric proof key issued by a WS-Trust symmetric-key holder-of-key STS.
### Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
### Workarounds
None
References
External links from the advisory. They lead to third-party sites.