Penetration Test Report (Hackmanit): Penetration Test Report SURF openconext saml java by Hackmanit

Source Code Analysis and Penetration Test
Report:
openconext-saml-java
Version: 1.0.1
15.01.2024
Juraj Somorovsky
|
Phone: +49(0)234/54459996 E-Mail: Juraj.Somorovsky@hackmanit.de
Project Information
Customer: SURFBV
Postbus19035
3501Utrecht,Netherlands
Contact: PeterHavekes
Commissionedto: HackmanitGmbH
Universitätsstraße60(Exzenterhaus)
44789Bochum,Germany
Projectexecutive: JurajSomorovsky
Phone: +49(0)234/54459996
Fax: +49(0)234/54427593
E-Mail: Juraj.Somorovsky@hackmanit.de
Projectmembers: KarstenMeyerzuSelhausen(HackmanitGmbH)
Projectperiod: 11.12.2023–19.12.2023
Versionofthereport: 1.0.1
ThisreportwastechnicallyverifiedbyJurajSomorovsky.
ThisreportwaslinguisticallyverifiedbyKarstenMeyerzuSelhausen.
HackmanitGmbH
Representedby: Prof. Dr. JörgSchwenk,Prof. Dr. JurajSomorovsky,
Dr. ChristianMainka,Prof. Dr. MarcusNiemietz
Registercourt: AmtsgerichtBochum,HRB14896,Germany
1
Contents
Contents
1 Summary 3
2 ProjectTimeline 4
3 Methodology 4
4 GeneralConditionsandScope 5
5 OverviewofWeaknesses,Recommendations,andInformation 6
6 Weaknesses 7
6.1 M01 XMLSignatureWrappingAttackTargetingSignedAuthenticationRequests 7
7 Recommendations 11
7.1 R01 ImprovingtheConfigurationofSecurity-RelatedHeaders. . . . . . . . . . 11
8 FurtherEvaluations 13
9 References 15
2
1 Summary
1 Summary
HackmanitGmbHwascommissionedbySURFtoperformasourcecodeanalysisandpenetra-
tiontestoftheiropen-sourcelibrary“openconext-saml-java”andanidentityprovider(IdP)test
implementationbasedonthelibrary. Thesourcecodeanalysisandpenetrationtestwereper-
formedremotelywithatotalexpenseoffourman-days–includingdocumentationandwriting
ofthisreport.
Weaknesses. During our penetration test, one weakness was identified and classified as
Medium. Theweakness M01 allowsanattackertoexecuteanXMLsignaturewrapping(XSW)
attackonSAMLauthenticationrequests,whichareprocessedbytheIdP.Withthisattack,itis
possible to arbitrarily modify the authentication request’s contents even if they are protected
byXMLSignatures.
TheimpactofthisattackonSAMLauthenticationrequestsisrathersmall;SAMLauthentication
requeststypicallyonlycontaindata,whicharedefinedintheIdPmetadata. Nevertheless,rely-
ingonavulnerableXMLSignaturevalidationcouldintroduceunrestrictedtrustinthemessage
contentandresultinweaknessesinfuturedeployments.
RecommendedActions. Aspartofthepenetrationtest,weimplementedJUnittestsevaluating
thisweaknesswith12maliciousfilesandcreatedapullrequesttosustainablypreventthiskind
ofweaknessinthedevelopmentprocess. Wealsopresentedcountermeasurescircumventing
theidentifiedweaknessesandrecommendimplementingthem.
Structure. Thereportisstructuredasfollows:InSection2,thetimelineofthepenetrationtest
is listed. Section 3 introduces our methodology and Section 4 explains the general conditions
andscopeofthepenetrationtest. Section5providesanoverviewoftheidentifiedweaknesses,
as well as, further recommendations and information. In Section 6, all identified weaknesses
arediscussedindetailandspecificcountermeasuresaredescribed.Section7summarizesour
recommendations resulting from observations of the application. Finally, Section 8 lists ad-
ditionalteststhatdidnotrevealanyweaknesses.
3
3 Methodology
2 Project Timeline
The source code analysis and penetration test were carried out remotely from 11.12.2023 to
19.12.2023. The library “openconext-saml-java” developed by SURF, as well as, an IdP test
implementationprovidedbySURFwereexaminedbytwopeoplewiththeentireeffortoffour
man-days–includingdocumentationandwritingofthisreport.
3 Methodology
Amongothers,thefollowingtoolswereusedforthepenetrationtest:
Tool Link
MozillaFirefox https://www.mozilla.org/de/firefox/
BurpSuiteProfessional https://portswigger.net/burp
Self-developedtools -
Risk Rating. Each weakness has its own CVSS 3.1 base score rating (Common Vulnerability
Scoring System Version 3.1 Calculator).1,2 Based on the CVSS 3.1 base score, the following
weaknessesassessmentisperformed:
0.0–3.9: Low
4.0–6.9: Medium
7.0–8.9: High
9.0–10.0: Critical
1https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
2https://www.first.org/cvss/v3.1/user-guide
4
4 GeneralConditionsandScope
4 General Conditions and Scope
In the scope of the penetration test / source code analysis was the open-source library
“openconext-saml-java” developed by SURF, as well as, a test implementation provided by
SURF.The“openconext-saml-java”libraryallowstoimplementaSAML-basedidentityprovider
(IdP). The source code is available on GitHub3 and was examined at the stage of commit
86f31be28d04d4da65a39b[PII_REDACTED]6d9f752.
SURF provided access to a test environment with a running IdP called “eduID (NL) test envi-
ronment”andSAMLserviceprovider(SP)called“OpenIDConnectPlayground”4. TheSPwas
notinthescopeofthepenetrationtest. Hackmanitcouldregisterowntestaccountsatthetest
IdPforthepenetrationtest. ThetestserviceswereavailableatthefollowingURLs:
Service URL
IdP https://login.test.eduid.nl
SP(outofscope) https://oidc-playground.test.surfconext.nl
Table1:Overviewoftestservicesusedduringthepenetrationtest.
3https://github.com/OpenConext/openconext-saml-java
4DespiteitsnametheSPsupportedbothOpenIDConnect(OIDC)andSAML.
5
5 OverviewofWeaknesses,Recommendations,andInformation
5 Overview of Weaknesses, Recommendations, and Information
RiskLevel Finding Reference
M01 XML Signature Wrapping Attack Targeting Signed Section6.1,page7
Authentication Requests: The IdP is vulnerable to
XMLSignatureWrappingattacks. Thisallowsanat-
tacker to bypass the protection provided by the sig-
nature and arbitrarily manipulate the request’s con-
tents.
R01 Improving the Configuration of Security-Related Section7.1,page11
Headers: Theconfigurationofsecurity-relatedHTTP
headerssetbytheIdPshouldbeimprovedtofurther
hardenitssecurity.
RiskDefinitions:
CriticalRisk Weaknesses classified as Critical can be exploited with very little
effort by an attacker. They have very large negative effects on the
testedsystem,itsusersanddata,orthesystemenvironment.
HighRisk Weaknesses classified as High can be exploited with little effort
by an attacker. They have a major negative impact on the tested
system,itsusersanddata,orthesystemenvironment.
MediumRisk Weaknesses classified as Medium can be exploited with medium
effort by an attacker. They have a medium negative impact on the
testedsystem,itsusersanddata,orthesystemenvironment.
LowRisk WeaknessesclassifiedasLowcanonlybeexploitedwithgreatef-
fort by an attacker. They have little negative impact on the tested
system,itsusersanddata,orthesystemenvironment.
Recommendation Recommendation identifies measures that may increase the secu-
rityofthetestedsystem. Implementationisrecommended,butnot
necessarilyrequired.
Information Observations classified as Information are usually no weaknesses.
Examples of these observations are unusual configurations and
possiblyunwantedbehaviorofthetestedsystem.
6
6 Weaknesses
6 Weaknesses
Inthefollowingsections,welisttheidentifiedweaknesses. Everyweaknesshasanidentifica-
tion name which can be used as a reference in the event of questions, or during the patching
phase.
6.1 M01 XML Signature Wrapping Attack Targeting Signed Authentication
Requests
ExploitabilityMetrics ImpactMetrics
AttackVector(AV) Network ConfidentialityImpact(C) Low
AttackComplexity(AC) Low IntegrityImpact(I) Low
PrivilegesRequired(PR) Low AvailabilityImpact(A) None
UserInteraction(UI) Required Scope(S) Unchanged
Subscore: 2.1 Subscore: 2.5
OverallCVSSScorefor M01 : 4.6
GeneralDescription. ToprotecttheintegrityandauthenticityofSAMLauthenticationrequests,
the whole AuthnRequest element can be digitally signed. The SAML specification [1] pre-
scribesthattheAuthnRequestelementisprotectedwithanenvelopedXMLSignature[2].
Listing1providesanexampleofasignedSAMLauthenticationrequest.
The present XML Signature references the AuthnRequest root element using its
ID (A524bd1eb-20b6-4f60-8d83-e56470b77580) and protects its integrity by
computing the digest value. This ensures authenticity and integrity of data con-
tained in the AuthnRequest