Offensive & Defensive SAML Security OWASP Top 10 • CWE • CVE Analysis

SAML 2.0 Security Vulnerability & Exploitation Laboratory

Interactive vulnerability simulator demonstrating real-world SAML attacks: XML Signature Wrapping (XSW), Token Replay, XML External Entity (XXE) injection, Comment Truncation (CVE-2018-0489), and Certificate Spoofing.

🔬 Live SAML Attack Simulation Console

Select a crafted adversary payload to inject against the NTMS Service Provider verification pipeline:

CVE-2012-0881 / OWASP SAML-01

XML Signature Wrapping (XSW-3)

Adversary Goal: Privilege Escalation to EnterpriseApp.Admin by forging an unsigned root assertion while preserving original signature in an extension element.

Crafted Attack Payload Sent to /saml/acs:

(Loading attack payload...)

SP Defense Result: 🛡️ BLOCKED & NEUTRALIZED

Cryptographic Defense Triggered:

Strict XML-DSig Reference URI validation & 1:1 Assertion DOM Path Verification

Technical Defense Mechanism:

The SP verified that the signed DOM element URI exactly matches the root Assertion consumed by the authorization engine. Unsigned root assertions are rejected.

Production Remediation:

1. Enforce strict XML schema validation. 2. Validate signature Reference URI matches processed Assertion.

Comprehensive Technical Breakdown: Top 6 SAML Exploits

How adversaries exploit architectural and parser flaws in SAML implementations, and how modern identity providers neutralize them.

🔀 Severity: Critical

1. XML Signature Wrapping (XSW)

Exploits discrepancies between the XMLDSig verification module and the application business logic.

Flawed Pattern:

doc.getElementsByTagName("Assertion")[0]

The verifier checks element B, but logic reads element A!

Defense: Ensure the signature validator returns the exact DOM node verified, and consume only that node for identity claims.

🔁 Severity: High

2. SAML Assertion Replay Attack

Attacker intercepts an employee's valid SAMLResponse and re-posts it later to establish a valid session.

Flawed Pattern:

Missing Assertion ID cache check

Ignoring NotOnOrAfter condition window

Defense: SP must cache consumed Assertion IDs in Redis/Memory until their NotOnOrAfter timestamp expires.

🗄️ Severity: Critical

3. XML External Entity (XXE) Injection

Attacker inserts a DOCTYPE with external entities into the SAML XML to exfiltrate files or trigger SSRF.

Injected Entity:

<!ENTITY xxe SYSTEM "file:///etc/passwd">

Parser resolves local file into NameID!

Defense: Completely disable DTD processing and external entity resolution in XML parser libraries.

💬 CVE-2018-0489

4. Comment Truncation Attack

Exploited in major SAML libraries (Duo, OneLogin). Inserting XML comments caused parsers to truncate username strings.

Vulnerable NameID:

admin@attacker.com

Parser only returned "admin", logging attacker in!

Defense: Concatenate all adjacent text nodes under the NameID element rather than relying on firstChild.nodeValue.

📜 CWE-347

5. Rogue Cert & Signature Stripping

Attacker creates self-signed X.509 cert and places it in <ds:KeyInfo>, or strips signatures entirely.

Flawed Pattern:

Trusting KeyInfo cert without pinning

Accepting unsigned Assertion

Defense: Pin the authentic Microsoft Entra ID certificate (NTMS-APP-SAML.cer) and reject any untrusted signer.

🌐 CWE-601

6. Open Redirect via RelayState

Attacker tampers with the RelayState parameter to bounce user to a malicious credential-harvesting phishing page.

Poisoned RelayState:

RelayState=https://evil-phish.com

SP executes res.redirect(req.body.RelayState)

Defense: Whitelist internal relative paths only (e.g., must begin with / and forbid external schemes).