XML Signature Wrapping in XML::Sig Perl Module

Executive Summary

XML::Sig versions before 0.71 for Perl are vulnerable to signature wrapping via duplicate ID. The function _get_signed_xml() resolves the SignedInfo Reference/@URI to a node using an XPath expression that returns the first matching node. If two elements share the same ID, the first one is used for verification, while an attacker can manipulate the second element. This allows an attacker to bypass signature validation and inject malicious content.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves XML::Sig for Perl before version 0.71, where signature wrapping can occur due to duplicate ID values. Detection requires checking installed Perl modules and reviewing XML processing logic for ID handling.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to bypass security checks and inject malicious content into XML documents. In a SAML2 context, it could place the contents of an Assertion under attacker control, potentially leading to unauthorized access or data manipulation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with standards like GDPR and HIPAA by allowing unauthorized modification of signed XML data, such as SAML2 assertions. If exploited, it may lead to improper access controls or data integrity violations, which are critical under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update XML::Sig to version 0.71 or later to address the signature wrapping vulnerability. Review XML documents for duplicate ID values in elements that should be unique. Ensure SAML2 assertions are validated with strict ID resolution to prevent attacker-controlled content injection.

Useful 0 Not Useful 0