Pwn2Own Ireland 2025 Bypassing Authentication via Synology D...

src/pentesting-web/saml-attacks/README.md

@@ -223,6 +223,30 @@ You can also use the Burp extension [**SAML Raider**](https://portswigger.net/ba
 
 With the signatures removed, allow the request to proceed to the target. If the Signature isn’t required by the Service
 
+## Fail-open SAML verification in unconfigured SSO handlers
+
+Some products keep the **SAML authentication endpoint reachable even when SSO was never configured**. If a constructor or config-loading error leaves security fields at language defaults such as `""` or `false`, the unconfigured path can become **less secure** than the configured one.
+
+### What to test
+
+- Reach the SAML ACS / login handler while SSO is **disabled**, **never configured**, or after deleting its config. The handler should fail closed before parsing attacker-controlled XML.
+- Check whether missing configuration skips initialization of fields such as the **signature verification mode**, **trusted issuer**, **audience**, **certificate path**, or **local-user policy**, while request processing still continues.
+- Look for **fail-open mode checks** such as `if mode in {response, assertion, both} verify_signature(...)` with **no rejecting `else`**. An empty / malformed mode can silently disable both response- and assertion-signature verification.
+- Compare **presence checks** with **normalized comparisons**. A whitespace-only `<Issuer>` can satisfy `issuer != null`, then be trimmed to `""` and match an empty configured issuer.
+- If time validation only runs when `<Conditions>` exists, try **omitting `Conditions` entirely** instead of forging timestamps.
+
+### Exploitation notes
+
+Once verification is bypassed, a **schema-valid but unsigned** `SAMLResponse` containing `Status=Success`, at least one `Assertion`, and an attacker-chosen `NameID` may be enough to authenticate as an arbitrary existing federated user.
+
+Practical details to check:
+
+- Some implementations accept the **first assertion** that passes local checks and ignore the rest.
+- If local usernames are blocked but values containing `\` or `@` are allowed, target an existing **directory identity** such as `DOMAIN\Administrator` or `user@domain`.
+- The forged value still needs to survive **account-resolution / canonical-name** checks performed after SAML parsing.
+
+A recent example of this pattern is the Synology DS925+ SAML SSO bypass documented by Chanze Lee.
+
 ## Certificate Faking <a href="#certificate-faking" id="certificate-faking"></a>
 
 ## Certificate Faking
@@ -468,5 +492,6 @@ The same parser weakness that gives an overread can also crash the SAML processi
 - [https://0xdf.gitlab.io/2026/03/03/htb-barrier.html](https://0xdf.gitlab.io/2026/03/03/htb-barrier.html)
 - [https://github.com/synacktiv/CVE-2024-45409](https://github.com/synacktiv/CVE-2024-45409)
 - [https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2](https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2)
+- [Pwn2Own Ireland 2025: Bypassing Authentication via Synology DS925+ SAML SSO](https://chanzep.github.io/posts/pwn2own-ireland-2025-bypassing-authentication-via-synology-ds925-saml-sso)
 
 {{#include ../../banners/hacktricks-training.md}}