SAML Attacks

It is commonly used for Single Sign On

SAML allows a user to log in to one service and access other services without entering the password again

In a normal SAML login the Identity Provider verifies the user and sends a SAML assertion to the Service Provider

The SAML assertion contains information that tells the Service Provider who the user is and what access they should receive

A SAML attack happens when an attacker manipulates or steals SAML related information to gain unauthorized access

Common SAML Attacks

SAML Response Manipulation

An attacker tries to modify the SAML response so that the Service Provider accepts a different identity or privilege

XML Signature Wrapping

An attacker manipulates the structure of a SAML XML message while trying to make the application validate one part of the message but process another part

Golden SAML

An attacker who gains access to the organizations SAML signing key may create fake SAML assertions

This can allow the attacker to impersonate users and potentially access many connected applications

SAML Token Theft

If a valid SAML assertion is stolen an attacker may try to reuse it to access the associated service depending on how the application handles sessions and token validation

Simple Example

A company uses SAML Single Sign On

The Identity Provider authenticates an employee

The Identity Provider sends a signed SAML assertion

The Service Provider verifies the assertion

The employee receives access

If an attacker compromises the SAML signing key they may be able to create fraudulent assertions

The Service Provider could then treat the attacker as a legitimate user

How to Prevent SAML Attacks

Protect SAML signing keys carefully

Use strong cryptographic algorithms

Validate SAML signatures correctly

Validate the issuer audience and timestamps

Use short expiration times for assertions

Monitor unusual Single Sign On activity

Apply least privilege

Keep Identity Provider and Service Provider software updated

SAML attacks are especially important in enterprise environments because one compromised identity system can potentially affect many connected applications