Sh-Cho

The HTTP-Redirect binding decoder decompresses SAML messages provided by an attacker without limiting the output size before signature validation. This allows an unauthenticated remote attacker to exhaust server memory, leading to a denial of service.

Cross-Origin Resource Sharing (CORS) policies configured for any-origin do not enforce path restrictions. This allows a website controlled by an attacker to read sensitive responses from excluded paths if an authenticated victim visits the site, credentials are enabled, and the browser transmits authentication credentials.

Attackers who can control file names can cause stored cross-site scripting (XSS), a technique where malicious scripts are permanently stored on the target server, when directory listing is enabled and a user views the listing.

Inconsistent request path normalization allows unauthenticated attackers to bypass path-based access controls and access protected resources.