Warn about Open Redirect and Reply attacks

Author: pitbulk

README.md

@@ -154,6 +154,37 @@ environment is not secure and will be exposed to attacks.
 
 In production also we highly recommended to register on the settings the IdP certificate instead of using the fingerprint method. The fingerprint, is a hash, so at the end is open to a collision attack that can end on a signature validation bypass. Other SAML toolkits deprecated that mechanism, we maintain it for compatibility and also to be used on test environment.
 
+
+### Avoiding Open Redirect attacks ###
+
+Some implementations uses the RelayState parameter as a way to control the flow when SSO and SLO succeeded. So basically the
+user is redirected to the value of the RelayState.
+
+If you are using Signature Validation on the HTTP-Redirect binding, you will have the RelayState value integrity covered, otherwise, and
+on HTTP-POST binding, you can't trust the RelayState so before
+executing the validation, you need to verify that its value belong
+a trusted and expected URL.
+
+Read more about Open Redirect [CWE-601](https://cwe.mitre.org/data/definitions/601.html).
+
+
+### Avoiding Reply attacks ###
+
+A reply attack is basically try to reuse an intercepted valid SAML Message in order to impersonate a SAML action (SSO or SLO).
+
+SAML Messages have a limited timelife (NotBefore, NotOnOrAfter) that
+make harder this kind of attacks, but they are still possible.
+
+In order to avoid them, the SP can keep a list of SAML Messages or Assertion IDs alredy valdidated and processed. Those values only need
+to be stored the amount of time of the SAML Message life time, so
+we don't need to store all processed message/assertion Ids, but the most recent ones.
+
+The OneLogin_Saml2_Auth class contains the [getLastRequestID](https://github.com/onelogin/php-saml/blob/107757b29402ec5b2525c3e37d58e3ed8ac56f6e/src/Saml2/Auth.php#L657), [getLastMessageId](https://github.com/onelogin/php-saml/blob/107757b29402ec5b2525c3e37d58e3ed8ac56f6e/src/Saml2/Auth.php#L793) and [getLastAssertionId](https://github.com/onelogin/php-saml/blob/107757b29402ec5b2525c3e37d58e3ed8ac56f6e/src/Saml2/Auth.php#L801) methods to retrieve the IDs
+
+Checking that the ID of the current Message/Assertion does not exists in the list of the ones already processed will prevent reply
+attacks.
+
+
 Getting started
 ---------------
 
@@ -760,6 +791,8 @@ $_SESSION['samlNameidSPNameQualifier'] = $auth->getNameIdSPNameQualifier();
 $_SESSION['samlSessionIndex'] = $auth->getSessionIndex();
 
 if (isset($_POST['RelayState']) && OneLogin\Saml2\Utils::getSelfURL() != $_POST['RelayState']) {
+    // To avoid 'Open Redirect' attacks, before execute the
+    // redirection confirm the value of $_POST['RelayState'] is a // trusted URL.
     $auth->redirectTo($_POST['RelayState']);
 }
 
@@ -1098,6 +1131,8 @@ if (isset($_GET['sso'])) {    // SSO action.  Will send an AuthNRequest to the I
 
     $_SESSION['samlUserdata'] = $auth->getAttributes(); // Retrieves user data
     if (isset($_POST['RelayState']) && OneLogin\Saml2\Utils::getSelfURL() != $_POST['RelayState']) {
+        // To avoid 'Open Redirect' attacks, before execute the
+        // redirection confirm the value of $_POST['RelayState'] is a // trusted URL.
         $auth->redirectTo($_POST['RelayState']);  // Redirect if there is a
     }                                             // relayState set
 } else if (isset($_GET['sls'])) {   // Single Logout Service

demo1/index.php

@@ -76,9 +76,9 @@
     $errors = $auth->getErrors();
 
     if (!empty($errors)) {
-        echo '<p>' . implode(', ', $errors) . '</p>';
+        echo '<p>' . htmlentities(implode(', ', $errors)) . '</p>';
         if ($auth->getSettings()->isDebugActive()) {
-            echo '<p>'.$auth->getLastErrorReason().'</p>';
+            echo '<p>'.htmlentities($auth->getLastErrorReason()).'</p>';
         }
     }
 
@@ -96,6 +96,8 @@
 
     unset($_SESSION['AuthNRequestID']);
     if (isset($_POST['RelayState']) && Utils::getSelfURL() != $_POST['RelayState']) {
+        // To avoid 'Open Redirect' attacks, before execute the
+        // redirection confirm the value of $_POST['RelayState'] is a // trusted URL
         $auth->redirectTo($_POST['RelayState']);
     }
 } else if (isset($_GET['sls'])) {
@@ -110,9 +112,9 @@
     if (empty($errors)) {
         echo '<p>Sucessfully logged out</p>';
     } else {
-        echo '<p>' . implode(', ', $errors) . '</p>';
+        echo '<p>' . htmlentities(implode(', ', $errors)) . '</p>';
         if ($auth->getSettings()->isDebugActive()) {
-            echo '<p>'.$auth->getLastErrorReason().'</p>';
+            echo '<p>'.htmlentities($auth->getLastErrorReason()).'</p>';
         }
     }
 }

demo2/consume.php

@@ -38,5 +38,5 @@
         echo 'No SAML Response found in POST.';
     }
 } catch (Exception $e) {
-    echo 'Invalid SAML Response: ' . $e->getMessage();
+    echo htmlentities('Invalid SAML Response: ' . $e->getMessage());
 }

demo2/index.php

@@ -43,7 +43,7 @@
         }
         echo '</tbody></table>';
         if (!empty($_SESSION['IdPSessionIndex'])) {
-            echo '<p>The SessionIndex of the IdP is: '.$_SESSION['IdPSessionIndex'].'</p>';
+            echo '<p>The SessionIndex of the IdP is: '.htmlentities($_SESSION['IdPSessionIndex']).'</p>';
         }
     } else {
         echo "<p>You don't have any attribute</p>";

endpoints/acs.php

@@ -18,7 +18,7 @@
 $errors = $auth->getErrors();
 
 if (!empty($errors)) {
-    echo '<p>' . implode(', ', $errors) . '</p>';
+    echo '<p>' . htmlentities(implode(', ', $errors)) . '</p>';
     exit();
 }
 
@@ -30,6 +30,8 @@
 $_SESSION['samlUserdata'] = $auth->getAttributes();
 $_SESSION['IdPSessionIndex'] = $auth->getSessionIndex();
 if (isset($_POST['RelayState']) && Utils::getSelfURL() != $_POST['RelayState']) {
+    // To avoid 'Open Redirect' attacks, before execute the
+    // redirection confirm the value of $_POST['RelayState'] is a // trusted URL.
     $auth->redirectTo($_POST['RelayState']);
 }
 
@@ -47,7 +49,7 @@
     }
     echo '</tbody></table>';
     if (!empty($_SESSION['IdPSessionIndex'])) {
-        echo '<p>The SessionIndex of the IdP is: '.$_SESSION['IdPSessionIndex'].'</p>';
+        echo '<p>The SessionIndex of the IdP is: '.htmlentities($_SESSION['IdPSessionIndex']).'</p>';
     }
 } else {
     echo _('Attributes not found');

endpoints/sls.php

@@ -19,5 +19,5 @@
 if (empty($errors)) {
     echo 'Sucessfully logged out';
 } else {
-    echo implode(', ', $errors);
+    echo htmlentities(implode(', ', $errors));
 }