New XSW Attack

[emanuelduss]

Add new XSW10 attack.

This can e.g. be used to exploit CVE-2021-28091 (https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0):

2.7.0 - June 1st 2021
----------------------
36 commits, 45 files changed, 1945 insertions, 177 deletions

* CVE-2021-28091: Fix signature checking on unsigned response with multiple assertions

  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28091

  When AuthnResponse messages are not signed (which is
  permitted by the specifiation), all assertion's signatures should be
  checked, but currently after the first signed assertion is checked all
  following assertions are accepted without checking their signature, and
  the last one is considered the main assertion.

  This patch :
  * check signatures from all assertions if the message is not signed,
  * refuse messages with assertion from different issuers than the one on
    the message, to prevent assertion bundling event if they are signed.

TODO:

• Add new XSW10 Attack (like XSW3 but evil assertion after the valid one; just switch the assertions).
• Create description and image
• Mention CVE number in description as an example

[noraj]

Portswigger discovered new XSW vectors using XML namespace collision in libxml2. See https://portswigger.net/research/the-fragile-lock.

TODO:

• Collision between the same Responses, one with xmlns prefix and one without
• Collision between the same Responses with samlp prefix, with duplicate attributes, one having samlp prefix and one not, and having a duplicate response but with attributes reordered. (need several combinations if there are several attributes)
• combination of both previous points
• redefining or injecting namespace declarations
• Void Canonicalization / Golden SAML Response

[noraj]

There is also this one https://portswigger.net/research/saml-roulette-the-hacker-always-wins.

• round-trip attack / injecting quotes and comments in assertions to abuser REXML parser.