3 ms·
Its kind of annoying to explain the vulnerability in a blog post and then omit the parser differential in question. It is like writing the introduction to a st
by bawolff 2y ago
Its kind of annoying to explain the vulnerability in a blog post and then omit the parser differential in question.
It is like writing the introduction to a story and omitting the climax.
- mdaniel 2y agoThe sibling comment's blog post <https://news.ycombinator.com/item?id=43374972 https://news.ycombinator.com/item?id=43374972> included the relevant detail: they were just doing (...//ds:DigestValue).firstChild.nodeValue without checking that .firstChild was a Node (in the offending case, it was a Comment). Thus, the non-canonical one saw the "masked" signature, the corrected one which tossed out comments saw a Node and when two implementations differ about a signed document hilarity will ensue
- bawolff 2y agoAre you sure that is the one for this blog post? i got the impression that was a different vuln for a different saml implementation. Also using comments to bypass saml is very old news. https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations https://duo.com/blog/duo-finds-saml-vulnerabilities-affectin... is a post from 2018 about it.
- mdaniel 2y agoEvidently it's not the same, sorry; it seems that I lept to conclusions with the two signature mismatch vulns by ahacker1 showing up so close to one another but opening the very tiny, very dark, code picture shows this seems to be xpath-centric, not nodeType as the workos link discussed
- blincoln 2y agoI'm guessing they didn't want to be directly responsible for dropping a zero-day that allows authorization bypass in countless systems across the planet before the parties responsible for those systems have a chance to fix them. I'm sure the specifics will come out sooner or later.