Intermediate LevelAuthentication & Authorization
What is XML Signature Wrapping (XSW) in SAML 2.0 and how do you defend against it?
❓ Interview Prompt: Explain SAML XML Signature Wrapping (XSW) vulnerabilities, DOM path mismatch, and XML schema validation.
XML Signature Wrapping (XSW) is a major vulnerability class affecting SAML 2.0 authentication implementations.
How XSW Attacks Work:
1
An attacker intercepts a legitimate, cryptographically signed SAML Response containing '<saml:Assertion ID="orig_100">'.
2
The attacker clones and injects a forged unsigned assertion ('<saml:Assertion ID="forged_999">') containing admin claims.
3
Due to flaws in flawed XML parsers, the signature validator verifies the valid signature on 'orig_100', but the business logic parser reads user identity from 'forged_999'!
Mitigations:
•
Perform strict XML Schema validation before parsing.
•
Validate that the signed Assertion XML element is identical to the Assertion element evaluated by business logic.
Code Implementation Example
typescript
// Secure SAML assertion extraction matching signed DOM element ID
function extractVerifiedSamlAssertion(samlDoc: Document, verifiedSignatureElementId: string) {
const assertion = samlDoc.querySelector('Assertion[ID="' + verifiedSignatureElementId + '"]');
if (!assertion) {
throw new Error('XSW Security Violation: Signed assertion ID does not match evaluated element!');
}
return parseAssertionClaims(assertion);
}💡Defending against SAML XML Signature Wrapping by strictly matching signed element IDs.
🎯 Interview Key Takeaway
Defend against SAML XML Signature Wrapping by verifying that business logic reads the exact XML element validated by the signature.
#SAML#XSW#XML Vulnerabilities#Security#Intermediate
Back to all Authentication & Authorization Questions→