Sudhanshu Dhage

This module enables a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. The issue occurs because the module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with permissions to configure this metadata could force the application to send requests to unintended destinations, potentially granting access to internal network resources. This is a Server-Side Request Forgery (SSRF), which is a flaw that allows an attacker to induce the server-side application to make requests to an arbitrary domain.

The `miniorange saml` module fails to correctly restrict access to specific administrative functionality. This flaw allows unauthorized users to perform forceful browsing to access restricted features or modify configuration values intended only for privileged users.

Improper certificate validation occurs when the module makes outbound HTTPS requests, allowing an Adversary in the Middle (AiTM) attack. An attacker capable of intercepting or redirecting network traffic can impersonate a trusted remote service to influence communications performed by the module.

The `miniorange saml` module does not sufficiently validate certain user-supplied URLs before performing redirects. This allows an attacker to redirect users to an external, untrusted website after authentication, which can be used to fake the source of data, facilitate phishing attacks, or increase the credibility of malicious links.

The module allows a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. It employs cryptographic constructions that deviate from security best practices. Specifically, the module uses non constant-time comparison logic for signature comparisons, which creates an observable timing discrepancy that may allow brute force attacks. Additionally, it generates SAML request identifiers using predictable values from non-cryptographic random number generation. These weaknesses may reduce the security margin of SAML authentication workflows.

Improper verification of cryptographic signatures allows for signature spoofing. The module fails to properly restrict the signature algorithm used to validate a SAML assertion, enabling the algorithm to be influenced by the incoming response instead of being tied to the key type configured for the Identity Provider (IdP). An attacker must be able to submit a crafted SAML response to exploit this issue.

This module allows a Drupal site to function as a SAML 2.0 Service Provider for authentication via an external identity provider. The issue occurs because the module does not sufficiently sanitize user-supplied data before displaying it in generated HTML, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.

This module enables a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. The issue occurs because the module fails to sufficiently sanitize certain values derived from SAML assertions before displaying them to users. This allows a malicious identity provider or an attacker capable of supplying crafted SAML attributes to execute cross-site scripting (XSS), which is a technique used to inject malicious scripts into web pages viewed by other users.

The module allows a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. It contains hard-coded credentials that may allow the retrieval of embedded sensitive data and the disclosure of information regarding associated services.

This module enables a Drupal site to function as a SAML 2.0 Service Provider for external identity provider authentication. The software stores sensitive authentication information insecurely, which could lead to the retrieval of embedded sensitive data by users who have access to the configuration or related system data.

An authentication bypass issue exists where the module does not sufficiently prevent the reuse of previously accepted SAML assertions. This allows a valid assertion to be replayed within its validity period, potentially enabling remote services to perform repeated authentication attempts using stolen credentials.

An unauthenticated reflected Cross-site Scripting (XSS) issue exists because the module does not sufficiently filter user-supplied input before outputting it during web page generation.

An authentication bypass issue exists due to insufficient validation of user-supplied input. This flaw allows an attacker to bypass the verification process during user registration, potentially leading to account takeover.

An LDAP Injection issue exists because the module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover information that should not normally be accessible.

This module enables SAML-protocol-based single-sign-on (SSO) on a Drupal site. An improper check for unusual or exceptional conditions allows for an authentication bypass, which can lead to privilege escalation.

The Drupal SAML SSO - Service Provider module does not properly sanitize user input, leading to a reflected Cross-Site Scripting (XSS) issue. This allows attackers to inject malicious scripts into web pages generated by the application. The module enables single sign-on (SSO) using the SAML protocol on Drupal sites.

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.8.0 Enterprise MFA - TFA for Drupal versions 5.2.0 through 5.2.0 Enterprise MFA - TFA for Drupal versions 0.0.0 through 5.0.* Enterprise MFA - TFA for Drupal versions 0.0.0 through 5.1.* Description: The issue affects the Enterprise MFA - TFA for Drupal module, allowing authentication bypass using an alternate path or channel. This is due to the module not sufficiently ensuring that known authorization routes are protected. Recommendations: For versions 0.0.0 through 4.8.0, update to version 4.8.0 or later. For version 5.2.0, update to version 5.2.1 or later. For versions 0.0.0 through 5.0.*, update to version 5.0.* or later. For versions 0.0.0 through 5.1.*, update to version 5.1.* or later. As a temporary workaround, consider restricting access to known authorization routes to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x Description: The issue is related to an Authentication Bypass by Capture-replay vulnerability in Enterprise MFA - TFA for Drupal. This allows remote services to be accessed with stolen credentials. Recommendations: For Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x, update to version 4.7.0 or later. For Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x, update to version 5.2.0 or later.

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel vulnerability in Enterprise MFA - TFA for Drupal, allowing authentication bypass. Recommendations: For Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x, update to version 4.7.0 or later. For Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x, update to version 5.2.0 or later.

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.6.x Enterprise MFA - TFA for Drupal versions 5.0.0 through 5.1.x Description: The issue is related to a Missing Authorization vulnerability in Enterprise MFA - TFA for Drupal, which allows Forceful Browsing. Recommendations: For versions 0.0.0 through 4.6.x, update to version 4.7.0 or later. For versions 5.0.0 through 5.1.x, update to version 5.2.0 or later.