id: GO-2023-2114
modules:
    - module: github.com/crewjam/saml
      versions:
        - fixed: 0.4.14
      vulnerable_at: 0.4.13
      packages:
        - package: github.com/crewjam/saml
summary: |-
    Cross-site scripting via missing binding syntax validation in
    github.com/crewjam/saml
description: |-
    The package does not validate the ACS Location URI according to the SAML binding
    being parsed. If abused, this flaw allows attackers to register malicious
    Service Providers at the IdP and inject Javascript in the ACS endpoint
    definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the
    redirection at the end of a SAML SSO Flow. Consequently, an attacker may perform
    any authenticated action as the victim once the victim's browser loads the SAML
    IdP initiated SSO link for the malicious service provider.
cves:
    - CVE-2023-45683
ghsas:
    - GHSA-267v-3v32-g6q5
credits:
    - Francesco Lacerenza from Doyensec
references:
    - advisory: https://github.com/crewjam/saml/security/advisories/GHSA-267v-3v32-g6q5
    - fix: https://github.com/crewjam/saml/commit/b07b16cf83c4171d16da4d85608cb827f183cd79
notes:
    - The fix introduced functions Endpoint.UnmarshalXML and IndexedEndpoint.UnmarshalXML, but we currently do not have a way to mark uses of xml.Unmarshal on a certain type as vulnerable.