CVE-2021-21238

PySAML2 <6.5.0: XML Signature wrapping vulnerability

• CVSS 6.5
• CWE-347 Improper Verification of Cryptographic Signature
• Input Validation and Sanitization
• Remote

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.

CVE

CVE-2021-21238

CWE

CWE-347 Improper Verification of Cryptographic Signature

CVSS base score

6.5

Published

2021-01-21

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update PySAML2 to version 6.5.0 or higher.

from saml2 import saml, sigver

def saml_response(saml_response):
    response = saml.Response(saml_response)

    try:
        sigver.verify_signature(response)
    except sigver.SignatureError as e:
        print("Signature verification failed:", e)
        return False

    return True

from saml2 import saml, sigver
from saml2.config import Config

config = Config().load("path/to/your/saml_config.conf")

entity = saml.SAML2Entity(config)

def saml_response(saml_response):
    response = entity.parse_response(saml_response, binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST')

    try:
        sigver.verify_signature(response)
    except sigver.SignatureError as e:
        print("Signature verification failed:", e)
        return False

    return True

@misc{vaitp:cve202121238,
  title        = {{PySAML2 <6.5.0: XML Signature wrapping vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-21238},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-21238/}}
}