-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/ssoready/ssoready | go | < 0.0.0-20241009153838-7f92a0630439 | 0.0.0-20241009153838-7f92a0630439 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper XML signature validation due to differential parsing behavior. The commit diff shows a critical modification to onlyPathHoistNamesInternal in path.go, where a check was added to prevent multiple matches for the next path segment. This indicates the original implementation lacked proper validation of XML structure uniqueness during signature verification, enabling attackers to craft malicious SAML assertions that would be parsed differently by IDP and SP components. The function's role in XML path processing for digital signatures directly aligns with the CWE-347 (signature verification flaw) described in the advisory.