PT-2024-13626 · Go-Saml · Go-Saml

Peter Stöckli · Published 2024-03-06 · Updated 2025-12-04 · CVE-2023-48703

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions go-saml versions all known versions

Description The go-saml library contains an authentication bypass issue due to the internal use of the xmlsec1 command line tool to verify SAML assertions without restricting the origin of the public key for signature verification. This allows an attacker to sign SAML assertions with a self-provided public key, such as an RSA key, embedded in the SAML token.

Recommendations For all known versions, consider forking the go-saml project and adding the command line argument --enabled-key-data with a value such as x509 or raw-x509-cert when calling the xmlsec1 binary in the verify function as a temporary workaround. However, this workaround must be carefully tested before use. Alternatively, projects should move to another SAML library or remove support for SAML from their projects.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-48703

GHSA-6H53-Q94J-348W

GO-2024-3048

Affected Products

Go-Saml

References · 9

• https://osv.dev/vulnerability/GO-2024-3048 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48703 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6h53-q94j-348w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48703 · Security Note
• https://github.com/RobotsAndPencils/go-saml · Note
• https://github.com/advisories/GHSA-6h53-q94j-348w · Note
• https://t.me/cveNotify/144772 · Telegram Post
• https://securitylab.github.com/advisories/GHSL-2023-121_go-saml__archived_ · Note
• https://t.me/cvenotify/73174 · Telegram Post