OneUptime SAML component XML instruction injection leading to identity forgery and unauthorized access
The vulnerability originates in anomalous transformation logic in the underlying cryptographic library during document canonicalization, which converts embedded processing instructions directly into plain text. An attacker can send a crafted signed response message over the network and, exploiting the difference between the original parsing mechanism and the signature baseline, covertly insert instructions inside a valid signature to tamper with identity fields. This path requires no prior authentication to trigger, breaks the verification logic and allows an unauthorized entity to obtain a high-privilege token.
Component
OneUptime is an open-source system monitoring platform for operations teams and enterprise users. Its core architecture uses a modular design integrat…
Type
Improper Verification of Cryptographic Signature (CWE-347)
Repo
github.com/OneUptime/oneuptime
· Stars 7420
Remediation
- It is recommended to extract fields strictly from a canonicalized data structure when parsing cryptographic messages, filter out illegal processing instruction nodes, and apply allowlist validation during verification. The parsing context must also be kept consistent with the cryptographic computation baseline, addressing this class of defect at the architectural level.
