SAML Vulnerability Lets Attackers Log in as Other Users

itman · Feb 27, 2018

Security researchers from Duo Labs and the US Computer Emergency Response Team Coordination Center (CERT/CC) will release security advisories today detailing a new SAML vulnerability that allows malicious attackers to authenticate as legitimate users without knowledge of the victim's password.

The flaw affects SAML (Security Assertion Markup Language), an XML-based markup language often used for exchanging authentication and authorization data between parties.

SAML's most important use if in single sign-on (SSO) solutions that allow users to log into accounts using one single identity. Unlike other shared authentication schemes —such as OAuth, OpenID, OpenID Connect, and Facebook Connect— SSO stores the user's identity on a central server on which users have accounts.

When users try to login into other enterprise apps, those apps (service providers - SP) make requests to the local SSO server (identity provider - IdP) via SAML.
Click to expand...

https://www.bleepingcomputer.com/ne...ability-lets-attackers-log-in-as-other-users/

Log in or Sign up

SAML Vulnerability Lets Attackers Log in as Other Users

itman Registered Member

Log in or Sign up

SAML Vulnerability Lets Attackers Log in as Other Users

itman Registered Member

Useful Searches