Penetration Test Report (Hackmanit): Penetration Test Report WAYF Identity Provider SAML and OpenID Connect by Hackmanit

Penetration Test Report:
WAYF Identity Provider (SAML and OpenID
Connect)
Version: 1.0.2
12.12.2023
Karsten Meyer zu Selhausen
|
Phone: +49(0)234/54459996 E-Mail: karsten.meyerzuselhausen@hackmanit.de
Project Information
Customer: WAYF/Danishe-InfrastructureCooperation
AsmussensAllé,Building305
DK-2800Lyngby,DENMARK
Contact: MadsFreekPetersen
Commissionedto: HackmanitGmbH
Universitätsstraße60(Exzenterhaus)
44789Bochum,Germany
Projectexecutive: KarstenMeyerzuSelhausen
Phone: +49(0)234/54459996
Fax: +49(0)234/54427593
E-Mail: karsten.meyerzuselhausen@hackmanit.de
Projectmembers: MaximilianHildebrand(HackmanitGmbH)
SebastianKrause(HackmanitGmbH)
Prof. Dr. JurajSomorovsky(HackmanitGmbH)
Projectperiod: 2023-04-11–2023-05-09
Versionofthereport: 1.0.2
ThisreportwastechnicallyverifiedbyKarstenMeyerzuSelhausen.
ThisreportwaslinguisticallyverifiedbyConradSchmidt.
HackmanitGmbH
Representedby: Prof. Dr. JörgSchwenk,Prof. Dr. JurajSomorovsky,
Dr. ChristianMainka,Prof. Dr. MarcusNiemietz
Registercourt: AmtsgerichtBochum,HRB14896,Germany
1
Contents
Contents
1 Summary 3
2 ProjectTimeline 5
3 Methodology 5
4 GeneralConditionsandScope 5
5 OverviewofWeaknesses,Recommendations,andInformation 12
6 Weaknesses 14
6.1 C01 IDSpoofing–ImpersonationofArbitraryVictimsPossible . . . . . . . . . 14
6.2 M01 ClickjackingAttackOnIdentityProvider(WAYF)(IdPW). . . . . . . . . . . 18
6.3 M02 InsufficientValidationof“Audience”Information . . . . . . . . . . . . . . . 19
7 Recommendations 22
7.1 R01 AddingSecurity-RelatedHeaders . . . . . . . . . . . . . . . . . . . . . . . . 22
7.2 R02 ImprovetheReplayAttackProtection. . . . . . . . . . . . . . . . . . . . . . 24
7.3 R03 WrongConversionofXML/JWTEncryptionAlgorithms . . . . . . . . . . . 25
7.4 R04 InsufficientValidationof<Signature>Elements’Count . . . . . . . . . 26
8 Information 27
8.1 I01 AutomaticModificationoftheeduPersonPrincipalNameClaim . . . 27
8.2 I02 ImprovableHandlingofUnsupportedresponse_typeValues . . . . . 28
9 FurtherEvaluations 30
9.1 SAML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
9.2 OpenIDConnect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
9.3 Miscellaneous . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
10 References 38
2
1 Summary
1 Summary
Hackmanit GmbH was commissioned by WAYF to perform a penetration test of their identity
provider(IdP)implementation(referredtoasIdPW inthisreport). IdPW servesasaninterme-
diaryintheWAYFecosystembetweenserviceproviders(SPs)andIdPsoperatedbydifferent
parties. The penetration test was performed remotely with a total expense of 10 man-days –
includingdocumentationandwritingofthisreport.
Weaknesses. During the penetration test a total of three weaknesses were identified: one
weaknessclassifiedasCriticalandtwoweaknessesclassifiedasMedium.
Thehighestrankedweakness, C01 , allowsanattackertoimpersonateanyvictimregistered
at any IdP in the WAYF ecosystem when authenticating to IdPW. Afterwards, IdPW issues a
response to the SP containing the victim’s identity. This allows the attacker to impersonate
any user at any SP in the WAYF ecosystem. IdPW is vulnerable because it allows to initiate
an authentication flow with an arbitrary IdP but to finish the flow with a response of an IdP
controlledbytheattacker.
ThefirstweaknessclassifiedasMedium, M01 ,allowstoembedtheconsent-pageandother
pagesofIdPW intoaniframe. Thiscanbeusedbyanattackertotrickavictimintounintention-
allyperformingaloginflow.
The second weakness classified as Medium, M02 , enables an attacker to use ID tokens or
SAML assertions – issued for a particular party but without valid “audience” information – for
anotherparty. Thiscanultimatelyenabletheattackertotakeoverthevictim’saccount.
Top Weaknesses:
RiskLevel Finding Reference
C01 ID Spoofing – Impersonation of Arbitrary Victims Section6.1,page14
Possible
RecommendedActions. Werecommendimplementingthecountermeasuresdescribedforthe
three identified weaknesses. Especially the countermeasures for C01 should be thoroughly
implementedtomitigatethehijackingofarbitraryaccountswithoutuserinteraction. Itshould
alsobeevaluatedtoimplementthefourrecommendations.
Weadditionallyrecommendtoperformaretesttoensurethattheproposedcountermeasures
areeffectiveandtheriskissuccessfullymitigated.
Retest. WAYF followed our recommendations and implemented the proposed countermea-
sures. Weconductedaretestandcanconfirmthatallidentifiedweaknessesweresuccessfully
fixed. WAYFimplementedthreeoutofourfouradditionalrecommendationsandresolvedboth
information.
3
1 Summary
Structure. Thereportisstructuredasfollows:InSection2,thetimelineofthepenetrationtest
is listed. Section 3 introduces our methodology and Section 4 explains the general conditions
andscopeofthepenetrationtest. Section5providesanoverviewoftheidentifiedweaknesses,
as well as further recommendations and information. In Section 6, all identified weaknesses
arediscussedindetailandspecificcountermeasuresaredescribed.Section7summarizesour
recommendations resulting from observations of the application. In Section 8, observations
of unusual configurations and possibly unwanted behavior of the application are described.
Finally,Section9listsadditionalteststhatdidnotrevealanyweaknesses.
4
4 GeneralConditionsandScope
2 Project Timeline
The penetration test was carried out remotely from 2023-04-11 to 2023-05-09. The WAYF
implementation of their IdP (referred to as IdPW in this report) was examined by four people
withtheentireeffortof10man-days–includingdocumentationandwritingofthisreport.
Somefinaltestingwasdonefrom2023-04-24to2023-04-26asagreed.
Whilethispenetrationtestreportswaswrittenanewattackideaemergedandwasevaluated
on2023-05-08and2023-05-09. Thesetestsresultedinidentificationof C01 .
Hackmanitconductedaretestoftheidentifiedweaknesseslaterin2023andcanconfirmthat
allweaknessesweresuccessfullyfixed. Inadditionthreeoutofthefourrecommendationslisted
inSection7werefulfilledandbothinformationlistedinSection8wereresolved,aswell.
3 Methodology
Amongothers,thefollowingtoolswereusedforthepenetrationtest:
Tool Link
MozillaFirefox https://www.mozilla.org/de/firefox/
GoogleChrome https://www.google.com/intl/de_ALL/chrome/
BurpSuiteProfessional https://portswigger.net/burp
Self-developedtools -
Risk Rating. Each weakness has its own CVSS 3.1 base score rating (Common Vulnerability
Scoring System Version 3.1 Calculator).1,2 Based on the CVSS 3.1 base score, the following
weaknessesassessmentisperformed:
0.0–3.9: Low
4.0–6.9: Medium
7.0–8.9: High
9.0–10.0: Critical
4 General Conditions and Scope
InthescopeofthepenetrationtestwastheimplementationofWAYF’sIdP(referredtoasIdPW
in this report). IdPW is based on “wayfhybrid” which is available on GitHub: https://github.c
om/wayf-dk/wayfhybrid.
WAYF provided access to a test environment including an IdP running the “wayhybrid” im-
plementation,aSPsupportingbothSecurityAssertionMarkupLanguage(SAML)andOpenID
1https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
2https://www.first.org/cvss/v3.1/user-guide
5
4 GeneralConditionsandScope
Connect (OIDC), and accounts at a real Identity Provider (GrandUnified) (IdPG). WAYF also
addedourownIdentityProvider(Hackmanit)(IdPH)totheecosystem. Thetestserviceswere
availableatthefollowingURLs:
Service URL
IdPW https://wayf.wayf.dk
SP https://wayfsp.wayf.dk
IdPG https://grandunified.deic.dk
Table2:Overviewoftestservicesusedduringthepenetrationtest.
Scope of the Penetration Test
User SP / Client IdP IdP / IdP
W GU H
wayfsp.wayf.dk wayf.wayf.dk grandunified.deic.dk
1. Start Login Hackmanit IdP URL
2. Authentication Request A
3. Authentication Request B
4. User Authentication
5. Authentication Response B
6. Authentication Response A
Figure1:AhighleveloverviewofthetestedSAMLandOIDCprotocolflow.
6
4 GeneralConditionsandScope
ThedeployedscenarioisdepictedinFigure1andcontainsofthefollowingsteps:
Step1: TheuservisitstheSPandstartstheloginprocess.
Step2: A SAML request is generate