Executive Summary

In Casdoor versions 2.362.0 and earlier, the SAML callback handler accepts any well-formed SAMLResponse sent to the /api/acs endpoint without verifying that it matches an AuthnRequest previously issued by Casdoor.

Additionally, if an administrator disables or deletes an Identity Provider (IdP) after a SAML authentication flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request.

This allows an attacker who controls a registered upstream IdP to send unsolicited SAML responses or replay a legitimately captured response in a different session or after the original flow has ended.

In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to gain persistent unauthorized access to the system by sending unsolicited or replayed SAML responses.

Such unauthorized access could lead to compromise of user accounts, sensitive data exposure, and potential further exploitation within the affected environment.

Useful 0 Not Useful 0