Reflected XSS in Admindo SSO/SAML Endpoint (modules/sso/index.php) via Unencoded Exception Messages

Vulnerability Overview Vulnerability Name: Reflected Cross-Site Scripting (XSS) in SSO/SAML Endpoint via Unencoded Exception Messages Vulnerability Description: A reflected Cross-Site Scripting (XSS) vulnerability exists in Admindo's SSO/SAML endpoint ( ). The outer exception handler directly echoes exception messages into the HTTP response without performing HTML encoding. Because the SAML request handling branch lacks its own try/catch wrapper (unlike the OIDC branch), multiple attacker-controlled error paths—including the SAML Issuer element and LightSAML library query parameters—pass through to the unencoded output via exception messages. With the Content-Type header not explicitly set for error paths (defaulting to ) and the absence of security headers such as , , and , an unauthenticated attacker can execute arbitrary JavaScript in the browsers of any user accessing the malicious SSO/SAML URL. This could lead to session hijacking, credential theft, or administrative account takeover. Impact Scope Affected Versions: = 5.0.11 Impact: This is a Reflected Cross-Site Scripting (XSS) vulnerability (CWE-79). It allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of any user who accesses a malicious SSO/SAML URL. Impacts Include: 1. Session Hijacking: Attackers can steal session cookies or extract session tokens from the DOM, gaining full access to the victim's Admindo account. 2. Credential Theft: If the target is an administrator, attackers can extract PII for all members (names, emails, addresses, phone numbers). 3. Privilege Escalation: By targeting administrators, attackers can create new admin accounts, modify roles/permissions, or change system settings. 4. SSO Trust Chain Compromise: Since this is an SSO Identity Provider (IdP) endpoint, compromise of an admin session could allow manipulation of SAML/OIDC client configurations, thereby endangering all associated Service Providers (SPs). Who Is Affected: Any Admindo instance with the SSO SAML feature enabled ( ). The attack requires no authentication; users only need to visit the URL. It can target any user, including administrators. The SSO SAML feature was introduced in v5.0.0 as part of the standard Single Sign-On integration functionality. Remediation 1. HTML Encode All Exception Output: In , ensure all exception output is HTML encoded. 2. Wrap SAML Branch in try/catch: In , wrap the SAML branch with a try/catch block, following the pattern used in the OIDC branch. 3. Add Global CSP and X-Content-Type-Options Headers: Globally add and headers. POC Code Prerequisites: SSO SAML must be enabled in Admindo settings ( ). Vector 1 — Issuer EntityID via CDATA Validation (Simulated with Python): Step 1: Create a SAML AuthnRequest with an XSS payload wrapped in CDATA Step 2: Encode the SAML HTTP-Redirect Binding (Deflate + Base64 + URL Encoding) Step 3: Send the crafted request (output verified) ``` GET /modules/sso/index.php/saml?SAMLRequest=<Z8B50HxETn7F5sx307ax40V3Aq2F2UfCLFg12Bm16uVq5r5bu3PPJ2B98Z0U02jTfJM7F2GKbvtPjKw7vC9v0101E12MPxg1o5B1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1oA1

Goal Reached Thanks to every supporter — we hit 100%!

Reflected XSS in Admindo SSO/SAML Endpoint (modules/sso/index.php) via Unencoded Exception Messages

More from this source