CVE-2020-5268: Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET
First published: Tue Apr 21 2020(Updated: )
In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some cases. Saml2 tokens are usually used as bearer tokens - a caller that presents a token is assumed to be the subject of the token. There is also support in the Saml2 protocol for issuing tokens that is tied to a subject through other means, e.g. holder-of-key where possession of a private key must be proved. The Sustainsys.Saml2 library incorrectly treats all incoming tokens as bearer tokens, even though they have another subject confirmation method specified. This could be used by an attacker that could get access to Saml2 tokens with another subject confirmation method than bearer. The attacker could then use such a token to create a log in session. This vulnerability is patched in versions 1.0.2 and 2.7.0.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sustainsys Saml2 | <1.0.2 | |
| Sustainsys Saml2 | >=2.0.0<2.7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-5268?
CVE-2020-5268 is a vulnerability in Saml2 Authentication Services for ASP.NET that affects token validation in certain versions.
What versions of Sustainsys Saml2 are affected by CVE-2020-5268?
Sustainsys Saml2 versions before 1.0.2 and between 2.0.0 and 2.6.0 are affected by CVE-2020-5268.
What is the impact of CVE-2020-5268?
The vulnerability could allow an attacker to bypass token validation and impersonate users.
How do I fix CVE-2020-5268?
To fix CVE-2020-5268, upgrade to Sustainsys Saml2 version 1.0.2 or any version above 2.6.0.
What type of authentication does CVE-2020-5268 involve?
CVE-2020-5268 involves SAML2 authentication, which commonly uses bearer tokens for user validation.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/title
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/first-publish-date
- agent/description
- agent/event
- agent/tags
- agent/source
- vendor/sustainsys
- canonical/sustainsys saml2
- version/sustainsys saml2/2.0.0