Uploaded image for project: 'Shibboleth SP - C++'
  1. Shibboleth SP - C++
  2. SSPCPP-714

Open Redirect in Logout Handler

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Invalid
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: None
    • Labels:
      None
    • Operating System:
      Multiple
    • CPU Type:
      Multiple
    • C/C++ Compiler:
      Multiple
    • Web Server:
      Multiple

      Description

      The Shibboleth Logout Handler has ever (and still does in 2.6) allow to redirect the user to an arbitrary absolute URL. This is an "Open Redirect" (https://www.owasp.org/index.php/Open_redirect, http://cwe.mitre.org/data/definitions/601.html) vulnerability, which allows to easier phish users, according to our security team.

      An example of such a URL could be:
      https://www.shibboleth.net/Shibboleth.sso/Logout?return=https%3A%2F%2Fwww.badgerbadgerbadger.com%2F

      I also checked if the same was possible with the SessionInitiator (/Shibboleth.sso/Login?return=) because I thought this also worked in past versions of the SP and IdP. However, it seems that there is no Open Redirect possible, at least not in recent versions.

      So, there still remains the Logout handler (and others) that may need some hardening.

        Attachments

          Activity

            People

            Assignee:
            cantor.2@osu.edu Scott Cantor
            Reporter:
            wkiyxkscr4bax/2pq5dvxwse0ei=@https://aai-logon.switch.ch/idp/shibboleth Lukas Haemmerle
            Watchers:
            0 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 15 minutes
                15m