SAML Authentication

Authentication Bypass: Mis-scoped SAML Sessions Enable User ImpersonationMedium

1. Sign into target.com as an organization owner (attacker).

2. Configure a SAML 2.0 Provider (Okta) on your attacker account by following SAML docs

3. Enable SAML authentication and Enable user provisioning

4. In your SAML IdP (Okta admin console), create/add a person with the victim email and set a password for that account.

Press enter or click to view image in full size

5. Also at Okta assign that newly created user to the Org application in Okta (so SAML assertions can be made).

• Okta assignments path : https://trial-#lol-admin.okta.com/admin/app/org/instance/<INSTANCE_ID>#tab-assignments

• Add user <[e-mail]> to the org app.

Press enter or click to view image in full size

6. Open an incognito/private browser window and navigate to your org’s SAML login URL (IdP-initiated) and sign-in with the victim email and the password you set in Okta:

• Email: [e-mail]

• Password: (the password attacker set during creation)

7. After successful IdP authentication, the SP ( target.com) issues a session. As the attacker (exploit actions enabled by the victim session)

8. With the attacker-controlled session that now contains the victim user id (but attacker account id in token), issue requests that rely on user id for authorization (example: edit user settings).