Pwn2Own Ireland 2025 Bypassing Authentication via Synology D...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://chanzep.github.io/posts/pwn2own-ireland-2025-bypassing-authentication-via-synology-ds925-saml-sso
• Blog Title: Pwn2Own Ireland 2025: Bypassing Authentication via Synology DS925+ SAML SSO
• Suggested Section: Pentesting Web > SAML Attacks > Fail-open SAML verification and unconfigured SSO authentication bypasses

🎯 Content Summary

Overview and impact

The post analyzes a pre-authentication SAML SSO bypass discovered against the Synology DS925+ for Pwn2Own Ireland 2025. The vulnerable state occurs when SAML SSO has never been configured: /usr/syno/etc/ssoclient/saml.conf does not exist, yet the SAML authentication handler remains reachable and does not reject requests because SAML is disabled.

The missing configuration causes security-sensitive members of SSOSAMLClient to remain at...

🔧 Technical Details

Reachable disabled authentication feature: A feature being disabled in the user interface does not protect it if its backend authentication endpoint remains reachable. Test SSO, OAuth, SAML, debug, and legacy authentication handlers in unconfigured states and verify whether they enforce an explicit enabled flag before parsing attacker-controlled credentials.

Missing configuration as an authentication-bypass primitive: An early constructor return can leave security-sensitive members at language defaults. If later code treats empty strings or false values as legitimate policy, an unconfigured service may be less secure than a configured one. Audit constructors and initialization failures for fields controlling signatures, issuers, audiences, certificates, algorithms, authorization, or local-user matching.

Fail-open cryptographic mode selection: Code that verifies signatures only when a string equals known values such as 🤖 Agent Actions

Done — I updated:

• src/pentesting-web/saml-attacks/README.md

Added a concise new section on:

• fail-open SAML verification in unconfigured SSO handlers
• missing-config auth bypass patterns
• fail-open mode selection for signature verification
• whitespace-only issuer normalization bypasses
• omitting Conditions
• targeting federated identities after SAML parsing

Also added the blog URL to the file’s ## References.

I kept everything in a single file and did not create new pages.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://chanzep.github.io/posts/pwn2own-ireland-2025-bypassing-authentication-via-synology-ds925-saml-sso

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > SAML Attacks > Fail-open SAML verification and unconfigured SSO authentication bypasses".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0