Skip to content
attack.paths
Connexion
← RegistryDossier · 5 steps · 4 edges

SAML signature wrapping (XSW) → impersonate admin

Capture a legitimate SAML response. Re-arrange the XML so the IdP's signature still validates against the original assertion, but the SP parses an attacker-injected assertion claiming Admin.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target SP uses a SAML library susceptible to XSW (Java OpenSAML pre-3.4, python-saml older versions). Attacker has any low-priv SAML response to manipulate.

§ Steps

  1. 01
    Exfil sensitive dataExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Capture own SAML responseInitial Access
    T1078— Valid Accounts
  3. 03
    POST modified response to SPLateral Movement
    T1550— Use Alternate Authentication Material
  4. 04
    SP parses attacker assertion → admin sessionPrivilege Escalation
    W-BFLA— Broken Function Level Authorization (API BFLA)
  5. 05
    Insert attacker assertion + restructure XMLCredential Access
    AUTH-SAML-XSW— SAML Signature Wrapping (XSW)

§ References

§ Frequently asked

What is the "SAML signature wrapping (XSW) → impersonate admin" attack path?
Capture a legitimate SAML response. Re-arrange the XML so the IdP's signature still validates against the original assertion, but the SP parses an attacker-injected assertion claiming Admin. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Exfil sensitive data (T1041) — a exfiltration primitive. Assumed environment: target SP uses a SAML library susceptible to XSW (Java OpenSAML pre-3.
What is the final impact of this kill-chain?
The final step lands on Insert attacker assertion + restructure XML (AUTH-SAML-XSW), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers