CVE-2023-36661

What it actually does

The flaw permits an unauthenticated remote attacker to induce the affected XML processing library to perform an arbitrary outbound HTTP request by supplying a malicious KeyInfo element in a SAML assertion or similar XML document, resulting in server-side request forgery.

Why it matters to the business

Organizations running affected identity-federation or XML-processing software face the risk that an external party can force internal systems to reach out to arbitrary destinations, potentially enabling reconnaissance of internal networks or abuse of internal services without direct authentication.

How an attack unfolds

An attacker first obtains the ability to submit a SAML response or XML document containing a crafted KeyInfo element to the vulnerable service; when the service parses the document it resolves the KeyInfo reference by issuing an outbound HTTP request to an attacker-chosen URL; because the request originates from the server, the attacker can reach internal resources or exfiltrate data that would otherwise be inaccessible.

How to fix it

Upgrade Shibboleth XMLTooling to version 3.2.4 or later, Shibboleth Service Provider to 3.4.1.3 or later on Windows, and any downstream packages that embed the affected XMLTooling code; apply the corresponding gnutls commit 95722940bbdd20deaab3a46e4b7fa799e125db59 where the library is used.

How to confirm the fix worked

Confirm the installed version of XMLTooling or the Shibboleth Service Provider is at or above the fixed releases; re-test any SAML or XML ingestion paths with a benign KeyInfo reference to ensure outbound requests are no longer issued for untrusted content.

Typical attack path

1. Identify a service endpoint that accepts SAML assertions or XML documents processed by the vulnerable library
2. Craft a KeyInfo element whose URI attribute points to an attacker-controlled or internal target
3. Submit the malicious document to the service
4. Observe or abuse the resulting outbound request issued by the server

How to detect it

Examine web-server and application logs for SAML or XML documents containing unusual KeyInfo elements with external or unexpected URI values; correlate any resulting outbound HTTP requests from the affected service with authentication events.

What your security team should do

• Prioritize patching all identity-provider and service-provider instances within the next maintenance window given the weaponized exploit maturity
• Add the fixed version numbers to the organization's approved software bill of materials and update dependency scanners accordingly
• Review network egress controls to limit the destinations that federation servers are permitted to contact