GHSA-4pv2-52v7-vrfx: Social-auth-core 4.7.0 before 7.0.0 Login CSRF via SAML RelayState
Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form, signing the victim into the attacker's account to capture entered data.
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using the SAML backend in Social-auth-core versions 4.7.0 through versions before 7.0.0 are affected. The issue concerns restoration of sessions identified by an unsigned RelayState parameter.
What does an attacker need to exploit this issue?
An attacker needs their own valid IdP response and RelayState, and must cause a victim's browser to submit them, such as through an auto-submitting form. No attacker authentication to the target application is stated as required.
What is the practical impact on a victim?
The victim can be signed into the attacker's account rather than their own. Data the victim enters while using that account may then be captured by the attacker.