PR #32 binds the read identity to the verified signature for <samlp:Response>. saml_verified_identity_is_signed returns early for any other root, so <samlp:LogoutRequest> keeps the shape the PR removed elsewhere.
For a LogoutRequest root, saml_doc_name_id (src/xml.c) takes the first saml:NameID in document order:
node = xmlSecFindNode(node, (xmlChar*)"NameID", (xmlChar*)SAML_XMLNS_ASSERTION);
saml_verify_doc verifies the first <ds:Signature> in document order. LogoutRequestType orders its children Issuer, Signature, Extensions, then NameID, and samlp:Extensions accepts ##other, which includes the assertion namespace. So a request that omits its own signature and carries a signed <saml:Assertion> inside <samlp:Extensions> verifies against that assertion, and the NameID read is the assertion subject rather than the request subject.
I could not turn this into a working attack. The signed assertion has to come from the IdP, so it carries the attacker own NameID, and logging themselves out is not interesting. It becomes exploitable if an IdP can be induced to issue an assertion naming another subject. Recording it because it is the same class of defect and the fix is small.
Suggested fix: apply the coverage check to LogoutRequest too, requiring the verified signature to cover the root, and read NameID from a direct child of the root instead of the first one anywhere. Relates to #34.
PR #32 binds the read identity to the verified signature for
<samlp:Response>.saml_verified_identity_is_signedreturns early for any other root, so<samlp:LogoutRequest>keeps the shape the PR removed elsewhere.For a
LogoutRequestroot,saml_doc_name_id(src/xml.c) takes the firstsaml:NameIDin document order:saml_verify_docverifies the first<ds:Signature>in document order.LogoutRequestTypeorders its childrenIssuer,Signature,Extensions, thenNameID, andsamlp:Extensionsaccepts##other, which includes the assertion namespace. So a request that omits its own signature and carries a signed<saml:Assertion>inside<samlp:Extensions>verifies against that assertion, and theNameIDread is the assertion subject rather than the request subject.I could not turn this into a working attack. The signed assertion has to come from the IdP, so it carries the attacker own
NameID, and logging themselves out is not interesting. It becomes exploitable if an IdP can be induced to issue an assertion naming another subject. Recording it because it is the same class of defect and the fix is small.Suggested fix: apply the coverage check to
LogoutRequesttoo, requiring the verified signature to cover the root, and readNameIDfrom a direct child of the root instead of the first one anywhere. Relates to #34.