SAML Session Termination via Unsigned LogoutRequest in pac4j

Executive Summary

This vulnerability in pac4j-saml before version 6.5.6 allows an unauthenticated attacker to terminate a victim's SAML session by submitting an unsigned LogoutRequest with a guessed identifier like an email address. The issue occurs because the SAML2LogoutValidator.validateLogoutRequest() method does not require signature validation of SAML LogoutRequest messages when no SessionIndex is provided by the IdP.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor SAML logout requests for missing signatures and validate if the SAML2LogoutValidator in pac4j-saml versions prior to 6.5.6 improperly processes unsigned LogoutRequests. Check logs for logout requests with NameID values but no SessionIndex, especially those using email addresses as identifiers.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to forcibly log out users from their SAML sessions without authentication, disrupting access to services. This could lead to denial of service or unauthorized session termination for legitimate users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized session termination. An attacker could force a user's session to end without authentication, potentially leading to unauthorized access or data exposure. GDPR requires protection of personal data and session integrity, while HIPAA mandates secure session management for protected health information. The lack of signature validation in SAML LogoutRequests undermines these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update pac4j-saml to version 6.5.6 or later to address the missing signature validation in SAML LogoutRequest handling. Ensure all SAML logout requests are properly signed and validated before processing.

Useful 0 Not Useful 0