Mark Madsen

**Name of the Vulnerable Software and Affected Versions** dropbox samly versions 0.3.0 and later **Description** An authentication bypass exists where an attacker can authenticate as the subject of a captured SAML assertion by resubmitting it. This occurs because the function `decode idp auth resp/3` in `lib/samly/helper.ex` calls `validate assertion/2`, which uses a default duplicate detector that does not perform any action. Consequently, the SAML 2.0 Web Browser SSO Profile requirement to use a bearer assertion only once is not enforced. An attacker who obtains a valid `SAMLResponse` from network traffic, browser history, or logs can repeatedly submit the same data to establish sessions as the assertion's subject until the `NotOnOrAfter` timestamp expires. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dropbox samly versions 0.3.0 and later **Description** An issue exists where the service provider fails to properly verify the authenticity of SAML responses. Specifically, the `validate authresp/3` function in `lib/samly/sp handler.ex` does not compare the `SubjectConfirmationData/@InResponseTo` attribute against the ID of the `AuthnRequest` issued by the service provider. Because the request ID is not persisted, the system cannot verify if the response corresponds to a request it actually made, which violates SAML 2.0 Core requirements. An attacker with a validly signed assertion from a trusted Identity Provider (IdP) for their own account and a `RelayState` matching the victim's session can establish an authenticated session using a response the service provider never requested. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.