Other nomination

SSO Wars: The Token Menace

Oleksandr Mirosh and Alvaro Muñoz

Two flaws in .NET single sign-on. An unvalidated algorithm name from a JWT header or an XML SignatureMethod reaches CryptoConfig, letting an attacker instantiate arbitrary types; Dupe Key Confusion adds a second KeyInfo element so signature validation uses the attacker's own key. Lets an attacker forge SAML assertions and log in as any user, plus denial of service and code execution.

Record

Researcher

Oleksandr Mirosh and Alvaro Muñoz

Format

Whitepaper

In the archive

• Nominated for the 2019 Top 10 Web Hacking Techniques

Related sources

• Talk recording
• Talk recording
• Talk recording

Tags

• auth-bypass
• saml
• jwt
• sso
• dotnet
• rce
• parser-differential
• cve
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Oleksandr Mirosh and Alvaro Muñoz, first published at the original source. Preserved copies are kept so the citation survives its host.