AI analysis
MojoX::Authentication versions before 0.006 for Perl are vulnerable to a SAML authentication bypass (CWE-347): parse_assertion in MojoX::Authentication::Model::SAML2 builds Net::SAML2::Binding::POST without a trust anchor (no cacert, cert_text or anchors argument), and with Net::SAML2 before 0.86 the signature on an unencrypted assertion is checked against the certificate the response itself carries rather than a configured IdP certificate. An attacker initiates a SAML login at a vulnerable application and then posts a SAML response signed with a certificate of their own; the subsequent audience, InResponseTo and timestamp checks are all satisfiable by the attacker. The response therefore authenticates any NameID the attacker chooses, letting them access any account the application maps to that identifier without possessing IdP credentials. Any Perl/Mojolicious application using MojoX::Authentication's SAML2 model for login is affected, and the flaw is rated critical (CVSS 3.1 9.8). No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS assigns a roughly 0.2% probability of exploitation within 30 days (13th percentile), indicating no known in-the-wild exploitation.
What to do: Upgrade MojoX::Authentication to 0.006 or later and also upgrade Net::SAML2 to 0.86 or later so unencrypted assertion signatures are verified against the configured IdP trust anchor. Until patched, disable or restrict SAML-based login on affected applications and review authentication logs for logins whose signing certificate is not your IdP's. Check whether your deployment uses MojoX::Authentication::Model::SAML2 with unencrypted assertions, which is the exposed code path.
Affected
| Perl/CPAN MojoX::Authentication | before 0.006 |
| Perl/CPAN Net::SAML2 | before 0.86 (involved dependency; its POST binding verifies unencrypted assertion signatures against the response-borne certificate) |
Estimated exposure
nicheunknown; plausibly at most in the thousands of deployments (niche CPAN module used only by Mojolicious apps that implement SAML login) — CPAN publishes no active-install telemetry for this distribution and the data contains none, so only deployment-pattern reasoning applies: this is an obscure Perl module whose exposed population is limited to Mojolicious applications using…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor. parse_assertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST->new with no cacert, cert_text or anchors argument, then passes the returned XML to Net::SAML2::Protocol::Assertion->new_from_xml with the IdP signing certificate as cacert. In Net::SAML2 before 0.86 that certificate guards only encrypted assertions, so the signature on an unencrypted assertion is checked against the certificate the response itself carries. An attacker starts a SAML login, then posts a response signed with a certificate of their own. The audience, InResponseTo and timestamp checks that follow are all satisfiable by the attacker, so the response authenticates any NameID it carries.