Open Redirect in OpenAM via SAML 1.x SSO

Executive Summary

This vulnerability is an open redirect flaw in OpenAM versions before 16.1.4 during SAML 1.x single sign-on processing. Attackers exploit loose matching of trusted-partner destinations to craft malicious links that redirect authenticated users to phishing sites after SAML authentication.

Useful 0 Not Useful 0

Detection Guidance

Check OpenAM logs for unusual SAML 1.x authentication requests to /SAMLAwareServlet or /SAMLPOSTProfileServlet with destination URLs resembling trusted partners. Monitor network traffic for redirects to unexpected domains after SAML 1.x SSO. Use tools like Wireshark to inspect SAML 1.x protocol traffic for malformed or suspicious destination parameters.

Useful 0 Not Useful 0

Impact Analysis

Users may be tricked into visiting attacker-controlled phishing sites after authenticating via SAML 1.x, potentially leading to credential theft or malware installation. The attack requires user interaction but no elevated privileges.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenAM to version 16.1.4 or later to enforce strict destination URL matching. If upgrading is not immediately possible, block access to /SAMLAwareServlet and /SAMLPOSTProfileServlet endpoints if SAML 1.x is not required. Configure realm Valid goto URL Resources to restrict post-authentication destinations. Increase user awareness to avoid clicking on suspicious links after SAML authentication.

Useful 0 Not Useful 0