Admindo SSO/SAML端点反射型XSS漏洞(CWE-79)

漏洞概述 漏洞名称: 反射型跨站脚本（XSS）在SSO/SAML端点通过未编码的异常消息 漏洞描述: 在Admindo的SSO/SAML端点（modules/sso/index.php）中，存在一个反射型跨站脚本（XSS）漏洞。外层异常处理程序直接将异常消息回显到HTTP响应中，没有进行HTML编码。由于SAML请求处理分支缺少自己的try/catch包装器（与OIDC分支不同），多个攻击者控制的错误路径——包括SAML Issuer元素和LightSAML库查询参数——通过异常消息传递到未编码的输出中。没有Content-Type头明确设置为错误路径（默认为text/html），也没有Content-Security-Policy、X-XSS-Protection或X-Content-Type-Options头存在，这使得未认证的攻击者可以在访问恶意SSO/SAML URL的任何用户的浏览器中执行任意JavaScript，可能导致会话劫持、凭证窃取或管理员账户接管。 影响范围 受影响版本: = 5.0.11 影响: 这是一个反射型跨站脚本（XSS）漏洞（CWE-79）。它允许未认证的攻击者在访问恶意SSO/SAML URL的任何用户的浏览器中执行任意JavaScript。 影响包括: 1. 会话劫持: 攻击者可以窃取会话cookie或从DOM中提取会话令牌，从而获得对受害者Admindo账户的完全访问权限。 2. 凭证窃取: 如果目标是管理员，攻击者可以提取所有成员PII（姓名、电子邮件、地址、电话号码）。 3. 特权升级: 通过针对管理员，攻击者可以创建新的管理员账户、修改角色/权限或更改系统设置。 4. SSO信任链破坏: 由于这是SSO IDP端点，管理员会话中的妥协可能导致对SAML/OIDC客户端配置的操纵，从而危及所有关联的服务提供商。 谁受影响: 任何启用了SSO SAML功能的Admindo实例（sso_saml_enabled = 1）。攻击不需要认证，用户只需访问URL即可，并且可以针对任何包括管理员的用户。SSO SAML功能在v5.0.0中引入，是Single Sign-On集成的记录功能。 修复方案 1. HTML编码所有异常输出: 在modules/sso/index.php:109中，对所有异常输出进行HTML编码。 2. 在SAML分支中包装try/catch: 在modules/sso/index.php:85-100中，按照OIDC分支使用的模式，在SAML分支中包装try/catch。 3. 全局添加Content-Security-Policy和X-Content-Type-Options头: 在全局范围内添加Content-Security-Policy和X-Content-Type-Options头。 POC代码 前置条件: SSO SAML必须在Admindo设置中启用（sso_saml_enabled = 1）。 向量1 — 通过CDATA验证的Issuer EntityID（使用Python模拟）: 步骤1: 创建一个带有CDATA包装XSS负载的SAML AuthnRequest 步骤2: 对SAML HTTP-Redirect绑定进行编码（Deflate + Base64 + URL编码） 步骤3: 发送构造的请求（已验证输出） ``` GET /modules/sso/index.php/saml?SAMLRequest=<Z8B50HxETn7F5sx307ax40V3Aq2F2UfCLFg12Bm16uVq5r5bu3PPJ2B98Z0U02jTfJM7F2GKbvtPjKw7vC9v0101E12MPxg1o5B1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Admindo SSO/SAML端点反射型XSS漏洞(CWE-79)

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Admindo SSO/SAML端点反射型XSS漏洞(CWE-79)

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！