CVE-2025-24894: SPID AspNetCore Auth Bypass Vulnerability

CVE-2025-24894 Overview

CVE-2025-24894 is a critical authentication bypass vulnerability in SPID.AspNetCore.Authentication, an AspNetCore Remote Authenticator for the Italian SPID (Sistema Pubblico di Identità Digitale) and CIE (Carta d'Identità Elettronica) digital identity systems. The vulnerability exists in the SAML2 signature validation logic, allowing attackers to forge SAML responses and impersonate any authenticated user.

SPID and CIE authentication relies on the SAML2 standard, which defines two key entities: Identity Providers (IDPs) that authenticate users and issue SAML assertions, and Service Providers (SPs) that consume these assertions to grant access. The signature validation mechanism is critical to ensuring that SAML responses cannot be arbitrarily crafted to impersonate users.

Critical Impact
Attackers can forge SAML responses to impersonate any SPID or CIE authenticated user, potentially gaining unauthorized access to government services and sensitive personal data.

Affected Products

SPID.AspNetCore.Authentication versions prior to 3.4.0
Applications using vulnerable SPID SDK for ASP.NET Core
Service Providers integrating with Italian SPID/CIE identity systems

Discovery Timeline

2025-02-18 - CVE CVE-2025-24894 published to NVD
2025-02-18 - Last updated in NVD database

Technical Details for CVE-2025-24894

Vulnerability Analysis

The vulnerability stems from a fundamental flaw in how the SPID.AspNetCore.Authentication library validates XML signatures in SAML responses. The validation logic does not guarantee that the first signature in the XML document refers to the root SAML response object.

When processing a SAML response containing multiple signatures, the library verifies signatures in document order without confirming that each signature is bound to its intended element. This allows an attacker to inject a legitimately signed XML element as the first element in the document, causing subsequent signatures (including those on critical assertion elements) to be skipped during validation.

The attack is particularly feasible because the only requirement is possession of any XML element legitimately signed by the IdP—a condition easily met using the IdP's publicly available metadata, which typically contains signed elements for service discovery purposes.

Root Cause

The root cause is improper authentication validation (CWE-287). The signature validation routine processes signatures sequentially without verifying that each signature corresponds to the correct XML element in the SAML hierarchy. This violates the security assumptions of the SAML2 protocol, which requires that the signature on the SAML Response and/or Assertion elements be explicitly validated.

The library fails to implement proper signature reference resolution, allowing signed elements from unrelated contexts (such as IdP metadata) to satisfy the signature verification requirement for the entire SAML response.

Attack Vector

The attack is network-based and can be executed without any privileges or user interaction. An attacker constructs a malicious SAML response containing:

A legitimately signed XML element obtained from the IdP's public metadata as the first child element
An attacker-crafted SAML assertion with arbitrary identity claims (unsigned or signed with an invalid key)

When the vulnerable library processes this crafted response, it validates the first legitimate signature and considers the overall response valid, ignoring the fact that the actual assertion containing identity claims is not properly signed. This enables complete identity impersonation against any Service Provider using the vulnerable SDK.

Detection Methods for CVE-2025-24894

Indicators of Compromise

Unusual SAML response structures with multiple root-level signed elements
SAML responses where the first signed element is not the Response or Assertion element
Authentication events for users that don't match expected access patterns
SAML assertions with metadata-derived signatures appearing in authentication flows

Detection Strategies

Implement SAML response logging that captures the full XML structure for forensic analysis
Monitor for authentication anomalies such as impossible travel or access from unexpected locations
Deploy application-level monitoring to detect SAML responses with unusual element ordering
Review authentication logs for users authenticated via SPID/CIE with suspicious timing or behavioral patterns

Monitoring Recommendations

Enable verbose logging for SAML authentication events in affected applications
Correlate SPID/CIE authentication events with user behavior analytics platforms
Monitor for rapid successive authentications as different users from the same source IP
Implement alerting on SAML signature validation events that may indicate exploitation attempts

How to Mitigate CVE-2025-24894

Immediate Actions Required

Upgrade SPID.AspNetCore.Authentication to version 3.4.0 or later immediately
Audit authentication logs for evidence of exploitation since deployment of vulnerable versions
Review all user sessions authenticated via SPID/CIE for suspicious activity
Consider forcing re-authentication for all active sessions authenticated through the vulnerable component

Patch Information

The vulnerability has been addressed in SPID.AspNetCore.Authentication version 3.4.0. The fix ensures proper signature validation by verifying that signatures are bound to the correct SAML Response and Assertion elements, rather than accepting any valid signature present in the document. All users of the library are strongly advised to upgrade immediately.

For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

No workarounds are available for this vulnerability—upgrading to version 3.4.0 is the only remediation
Temporarily disable SPID/CIE authentication if upgrade cannot be performed immediately
Implement additional authorization checks at the application layer as a defense-in-depth measure
Consider deploying a Web Application Firewall (WAF) with SAML inspection capabilities as a temporary measure

bash

# Upgrade SPID.AspNetCore.Authentication via NuGet
dotnet add package SPID.AspNetCore.Authentication --version 3.4.0

# Verify installed version
dotnet list package | grep -i spid