SSO Wars: The Token Menace
summary
Two .NET flaws let forged SSO tokens bypass verification and run code: an algorithm-to-type mapping allows arbitrary constructor invocation via unvalidated type names (used by SharePoint and Exchange to leak product info or trigger exceptions), and an XML Signature handling mismatch yields keyinfo duplication bypass by returning different results from resolveSecurityKey vs resolveSecurityToken, enabling token resigning and full mailbox takeover (demonstrated against on‑prem and Office365 Exchange). Deliverables include a Burp plugin to resign SAML tokens and coordinated Microsoft patches.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 2:00Authentication
- 4:06Token parsing
- 9:16Windows Communication Foundation
- 15:58Windows Identity Foundation
- 19:36Conclusions
related talks
47mThe Storm-0558 Attack - Inside Microsoft Identity Security's Response
31mIdentity Theft: Attacks on SSO Systems
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
47mToolShell, Patch Bypass, and the AI That Might Have Seen It Coming
45mThe Code Behind The Vulnerability
40mThe Attacker’s Guide to SSO and Passwordless Technologies
58mThe Code Behind The Vulnerability
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research