| Package | Affected versions | Patched versions |
|---|---|---|
| CoreWCF.Primitives | ≥ 1.9.0, < 1.9.1< 1.8.1 | 1.9.11.8.1 |
Full impersonation of any principal the trusted STS could have issued an assertion for — including administrative principals when the relying party grants them via SAML claims. Affects both SAML 1.1 and SAML 2.0.
Relying-party service is hosted with WSFederationHttpBinding or WS2007FederationHttpBinding (or any binding that triggers FederatedSecurityTokenManager for issued-token validation), and IdentityConfiguration is wired (UseIdentityConfiguration = true). Attacker can reach the service over the network and knows the trusted STS’s public certificate (public certs are by design discoverable).
Fixed in CoreWCF v1.8.1 and v1.9.1
None
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free