CVE-2023-48703: Go-saml Authentication Bypass Vulnerability

CVE-2023-48703 Overview

CVE-2023-48703 is an authentication bypass vulnerability affecting RobotsAndPencils go-saml, a SAML client library written in Go. The vulnerability exists in all known versions of the library and stems from insecure invocation of the xmlsec1 command line tool used to verify SAML assertion signatures. This flaw allows attackers to bypass authentication by signing SAML assertions themselves and embedding their own public key directly within the SAML token.

Critical Impact

Attackers can completely bypass SAML-based authentication by forging signed assertions with attacker-controlled keys, potentially gaining unauthorized access to protected resources and applications.

Affected Products

• RobotsAndPencils go-saml (all known versions)

Discovery Timeline

• 2024-03-06 - CVE CVE-2023-48703 published to NVD
• 2025-12-04 - Last updated in NVD database

Technical Details for CVE-2023-48703

Vulnerability Analysis

This authentication bypass vulnerability (CWE-287) exists due to improper configuration when calling the xmlsec1 binary for SAML signature verification. The go-saml library fails to restrict the source of public keys used during the signature verification process. When xmlsec1 is invoked without the --enabled-key-data parameter, it accepts public keys from any source, including those embedded directly within the SAML assertion itself.

This architectural flaw fundamentally breaks the trust model of SAML authentication. In a properly implemented SAML flow, the Service Provider (SP) should only accept signatures verified against known, pre-configured Identity Provider (IdP) certificates. However, this vulnerability allows an attacker to completely sidestep this trust relationship.

Root Cause

The root cause lies in the verify function's implementation where the xmlsec1 command line tool is called without specifying the --enabled-key-data parameter. Without this restriction, xmlsec1 does not limit which key data types can be used for signature verification, allowing embedded keys (such as RSA keys directly within the SAML token) to be accepted as valid verification keys.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker can exploit this vulnerability through the following process:

1. Craft a malicious SAML assertion - The attacker creates a SAML assertion with arbitrary claims (e.g., elevated privileges, different user identity)
2. Generate an attacker-controlled key pair - The attacker generates their own RSA key pair
3. Sign the assertion - Using the private key, the attacker signs the malicious SAML assertion
4. Embed the public key - The attacker includes their public key directly within the SAML token structure
5. Submit to the vulnerable application - When the application verifies the signature using xmlsec1, it accepts the embedded key and validates the attacker's signature as legitimate

This allows complete authentication bypass, enabling attackers to impersonate any user or claim arbitrary roles and permissions within the target application.

Detection Methods for CVE-2023-48703

Indicators of Compromise

• SAML assertions containing embedded public keys rather than referencing pre-configured IdP certificates
• Authentication events with unusual key identifiers or certificate signatures that don't match known IdP certificates
• Sudden appearance of authenticated sessions for users with claims that weren't issued by the legitimate Identity Provider

Detection Strategies

• Implement monitoring for SAML assertion processing that flags tokens containing inline key data
• Deploy application-level logging to capture the source of verification keys used during SAML authentication
• Review authentication logs for anomalous login patterns or unexpected privilege escalations following SAML-based authentication

Monitoring Recommendations

• Enable verbose logging on xmlsec1 operations to track which key sources are being used for signature verification
• Implement alerts for authentication events where the signing certificate doesn't match the expected IdP certificate fingerprint
• Monitor for applications or services using the go-saml library in your environment through software composition analysis tools

How to Mitigate CVE-2023-48703

Immediate Actions Required

• Migrate away from RobotsAndPencils go-saml to a maintained and secure SAML library for Go applications
• If SAML is not critical to your application, consider removing SAML support entirely until migration is complete
• Conduct an audit of all applications using go-saml to assess exposure and prioritize remediation

Patch Information

There is no official patch available for this vulnerability. The go-saml project is archived and no longer maintained. Organizations should migrate to alternative SAML libraries. For more information, refer to the GitHub Security Lab Advisory GHSL-2023-121.

Workarounds

• Fork the go-saml project and modify the verify function to include the --enabled-key-data argument when calling xmlsec1
• Specify a restrictive value such as x509 or raw-x509-cert for the --enabled-key-data parameter to limit accepted key sources
• Thoroughly test any forked implementation in a non-production environment before deployment

# Example workaround configuration for xmlsec1
# Add --enabled-key-data flag to restrict key sources
xmlsec1 --verify --enabled-key-data x509 --id-attr:ID urn:oasis:names:tc:SAML:2.0:assertion:Assertion assertion.xml