SAML: PySAML2 SSRF

This course provides a detailed examination of exploiting an insecure SAML implementation, which allows a malicious user to trigger a Server-Side Request Forgery (SSRF) through a manipulated SAMLResponse. The course highlights a specific vulnerability that impacted the Python library pysaml2, providing real-world context by referencing a documented issue on GitHub.

The course explains the process the Service Provider follows when receiving a SAMLResponse from the Identity Provider, emphasizing the importance of signature verification and information extraction. It identifies a critical flaw in the usage of the xmlsec1 binary within pysaml2, which is not called with the correct options, leading to potential security risks. The concluding section underscores the importance of detecting and fixing such vulnerabilities, especially as Single Sign-On (SSO) becomes more prevalent in enterprises.