Authentication Bypass via Forged SAML Certificates in Casdoor

Executive Summary

Casdoor versions 2.362.0 and earlier have a vulnerability that allows an attacker to bypass authentication.

This happens because the buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted pre-configured Identity Provider certificate.

As a result, an attacker can forge assertions signed with an attacker-controlled key, effectively bypassing authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to bypass authentication mechanisms.

By forging assertions with an attacker-controlled key, unauthorized users could gain access to systems or data protected by Casdoor.

This could lead to unauthorized access, data breaches, or other security incidents.

Useful 0 Not Useful 0