Paupu

Name of the Vulnerable Software and Affected Versions: SPID.AspNetCore.Authentication versions prior to 3.4.0 Description: The issue is related to the validation logic of SAML assertions in the SPID.AspNetCore.Authentication library. An attacker could create an arbitrary SAML response that would be accepted by Service Providers (SPs) using vulnerable SDKs, allowing them to impersonate any Spid and/or CIE user. The vulnerability is based on the fact that there is no guarantee that the first signature refers to the root object, and if an attacker injects a signed element as the first element, all other signatures will not be verified. The only requirement is to have a legitimately signed XML element from the Identity Provider (IdP), which is easily accomplished using the public metadata of the IdP. Recommendations: For versions prior to 3.4.0, upgrade to version 3.4.0 or later to resolve the issue. As a temporary workaround, consider verifying all signatures within the SAML response and do not accept unsigned XML elements. Restrict access to the vulnerable `VerifySignature` function until a patch is available. Avoid using the `signedDocument` parameter in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: CIE.AspNetCore.Authentication versions prior to 2.1.0 Description: The issue concerns the validation logic of SAML assertions within SAML responses in CIE.AspNetCore.Authentication. In affected versions, there is no guarantee that the first signature refers to the root object, allowing an attacker to inject a signed element as the first element, which would prevent the verification of other signatures. This could enable an attacker to craft an arbitrary SAML response that would be accepted by Service Providers (SPs) using vulnerable SDKs, allowing them to impersonate any Spid and/or CIE user. The only requirement for an attacker is to have a legitimately signed XML element from the Identity Provider (IdP), which can be easily obtained using the public metadata of the IdP. Recommendations: For versions prior to 2.1.0, upgrade to version 2.1.0 or later to address the issue. As a temporary workaround, consider verifying all signatures within the SAML response and not accepting unsigned XML elements to minimize the risk of exploitation. Restrict access to the vulnerable `VerifySignature` function until a patch is available. Avoid using the `signedDocument` parameter in the affected API endpoint until the issue is resolved.

The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled.

The issue arises from improper sanitization of user input before it is used in a SQL statement, leading to a SQL Injection in the `CompanyDetails` operation of the `MailManager` module.

The issue concerns incorrect user privilege checking, allowing a low-privileged user to interact directly with the "Migration" administrative module. This enables the user to disable arbitrary modules.

The issue is related to Reflected Cross-Site Scripting via the `target id` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.