CVE-2020-27847

Vulnerability

The vulnerability exists in the SAML connector of the github.com/dexidp/dex library, affecting versions before 2.27.0. The flaw allows an attacker to bypass SAML signature validation due to XML round-trip issues in Go's standard library encoding/xml. This enables a SAML authentication bypass [1][2][3].

Exploitation

An attacker can exploit this by crafting a SAML response that, due to XML round-trip issues, appears to have a valid signature but is interpreted differently by the XML decoder. No prior authentication is required, as the attacker sends a malicious SAML assertion directly to the service provider. The issue is triggered during SAML response processing [1][3].

Impact

Successful exploitation allows an attacker to completely bypass SAML authentication, impersonating any user. This leads to full compromise of confidentiality, integrity, and availability of the application relying on dex for authentication [2][3].

Mitigation

The vulnerability is fixed in dex version 2.27.0, released on 2020-12-17. Users should upgrade to this version or later. As of the references, no workaround is available. Users of Red Hat Advanced Cluster Management for Kubernetes 2.1 were informed that the vulnerable library is not used in production and will be removed in a future update [2][3][4].