CVE-2023-48703

Summary

CVE-2023-48703 is a newly disclosed vulnerability affecting the RobotsAndPencils go-saml library, a widely used SAML client library written in Go. The issue lies in the library's internal use of the `xmlsec1` command-line tool for signature verification of SAML assertions. If `xmlsec1` is called without specifying the enabled key data, the library unintentionally accepts any public key presented by an attacker for signature verification. This vulnerability allows an attacker to bypass authentication and sign SAML assertions, potentially leading to unauthorized access. Projects using go-saml should consider migrating to an alternative SAML library or disabling SAML support until a patch is available. A workaround involves forking the go-saml project and adding the `--enabled-key-data` argument with a specific value when invoking `xmlsec1` for signature verification. However, this workaround necessitates careful testing before implementation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.