From 14de31d77969ecf85381ce160631bb8a7c7b638b Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Fri, 31 Jul 2026 02:37:52 +0000 Subject: [PATCH] Add content from: Pwn2Own Ireland 2025: Bypassing Authentication via Synology ... --- src/pentesting-web/saml-attacks/README.md | 25 +++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/src/pentesting-web/saml-attacks/README.md b/src/pentesting-web/saml-attacks/README.md index d2cec51da44..9baa04155e1 100644 --- a/src/pentesting-web/saml-attacks/README.md +++ b/src/pentesting-web/saml-attacks/README.md @@ -223,6 +223,30 @@ You can also use the Burp extension [**SAML Raider**](https://portswigger.net/ba With the signatures removed, allow the request to proceed to the target. If the Signature isn’t required by the Service +## Fail-open SAML verification in unconfigured SSO handlers + +Some products keep the **SAML authentication endpoint reachable even when SSO was never configured**. If a constructor or config-loading error leaves security fields at language defaults such as `""` or `false`, the unconfigured path can become **less secure** than the configured one. + +### What to test + +- Reach the SAML ACS / login handler while SSO is **disabled**, **never configured**, or after deleting its config. The handler should fail closed before parsing attacker-controlled XML. +- Check whether missing configuration skips initialization of fields such as the **signature verification mode**, **trusted issuer**, **audience**, **certificate path**, or **local-user policy**, while request processing still continues. +- Look for **fail-open mode checks** such as `if mode in {response, assertion, both} verify_signature(...)` with **no rejecting `else`**. An empty / malformed mode can silently disable both response- and assertion-signature verification. +- Compare **presence checks** with **normalized comparisons**. A whitespace-only `` can satisfy `issuer != null`, then be trimmed to `""` and match an empty configured issuer. +- If time validation only runs when `` exists, try **omitting `Conditions` entirely** instead of forging timestamps. + +### Exploitation notes + +Once verification is bypassed, a **schema-valid but unsigned** `SAMLResponse` containing `Status=Success`, at least one `Assertion`, and an attacker-chosen `NameID` may be enough to authenticate as an arbitrary existing federated user. + +Practical details to check: + +- Some implementations accept the **first assertion** that passes local checks and ignore the rest. +- If local usernames are blocked but values containing `\` or `@` are allowed, target an existing **directory identity** such as `DOMAIN\Administrator` or `user@domain`. +- The forged value still needs to survive **account-resolution / canonical-name** checks performed after SAML parsing. + +A recent example of this pattern is the Synology DS925+ SAML SSO bypass documented by Chanze Lee. + ## Certificate Faking ## Certificate Faking @@ -468,5 +492,6 @@ The same parser weakness that gives an overread can also crash the SAML processi - [https://0xdf.gitlab.io/2026/03/03/htb-barrier.html](https://0xdf.gitlab.io/2026/03/03/htb-barrier.html) - [https://github.com/synacktiv/CVE-2024-45409](https://github.com/synacktiv/CVE-2024-45409) - [https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2](https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2) +- [Pwn2Own Ireland 2025: Bypassing Authentication via Synology DS925+ SAML SSO](https://chanzep.github.io/posts/pwn2own-ireland-2025-bypassing-authentication-via-synology-ds925-saml-sso) {{#include ../../banners/hacktricks-training.md}}