Image: files.cyberriskalliance.com · rights & removal

SAML assertion forgery: how the attack works and how to stop it

Reporting by SC MagazineRead the original at scworld.com

Executive Summary

Compromise of identity provider infrastructure exposes all federated applications reliant on the trust relationship established via SAML signing keys. Threat actors with access to these private keys can forge valid assertions, potentially targeting administrative accounts to bypass multi-factor authentication across connected services without generating standard IdP authentication logs. Detection is difficult because this activity often bypasses typical monitoring. Key signals for pre-compromise include reads of the Distributed Key Manager (DKM) container in Active Directory and access to ADFS configuration databases or signing certificate export operations. Anomalies in SAML assertions, specifically regarding the InResponseTo field, and timing discrepancies where assertions are issued significantly before the received timestamp, offer supplementary detection signals.

Facts Only

* IdP infrastructure breaches compromise all federated applications relying on the trust relationship.
* Threat actors with private signing keys can forge valid SAML assertions for arbitrary users.
* Detection is difficult as these actions do not generate standard IdP authentication logs.
* Access to the DKM container in Active Directory is a high-confidence pre-compromise signal.
* Monitoring should focus on AD Event 4662 on the DKM container and ADFS signing certificate export operations.
* Unsolicited or anomalous assertions can indicate injection attempts.
* Timing anomalies, such as NotBefore offsets greater than five minutes or validity windows exceeding one hour, provide a weak supplementary signal.
* XSW attacks succeed when signature validation passes against the original signed element.
* Assertion replay and injection bypass normal flows if signing keys are available.

Full Take

The narrative highlights a systemic risk where control over the Identity Provider infrastructure grants an adversary equivalent access to all downstream systems, creating a "tier 0" security posture that demands commensurate protection. The exploitation of SAML forging stems from a failure in boundary enforcement and signature validation logic within Service Providers, allowing manipulated XML structures to be accepted if parsing is lenient or misconfigured, which manifests as XML Signature Wrapping (XSW) vulnerabilities. The defense strategy moves from reactive detection—monitoring AD and ADFS operations—to proactive structural hardening by treating the IdP as critical infrastructure requiring domain controller-level controls. The failure of standard monitoring to catch this attack underscores a fundamental gap: relying on transaction logs alone is insufficient when attacks are designed to appear legitimate. The implication is that resilience requires building systemic checks across the entire federation chain, not just monitoring endpoint events, demanding a focus on validating flow context (like InResponseTo) and enforcing strict temporal constraints beyond mere signature checks.

From the original · SC Magazine

When identity provider (IdP) infrastructure is breached, exposed SAML signing keys compromise every federated application relying on that trust relationship. Threat actors with access to these private keys can forge valid assertions for arbitrary users—commonly targeting administrative accounts to skirt multifactor authentication across all connected services.

Read the full story at scworld.com

Sentinel — Human

Confidence

This is a highly detailed, technically dense analysis that reads like expert-level security documentation, demonstrating strong human synthesis of complex threat modeling and mitigation strategies.

Signals Detected

Sentence length variance is slightly erratic; the structure shifts between declarative statements and instruction sets.

Maintains strong, dense focus throughout the complex technical discussion, typical of expert-written security guidance.

Highly structured progression from detection signals to hardening steps to incident response, matching a deliberate instructional pattern.

Citations of specific CVEs, MITRE ATT&CK techniques, and specific technical concepts (DKM, XSW) are highly specific and grounded in real-world security literature.

Human Indicators

The text utilizes complex, nested conditional logic and prescriptive steps that reflect deep operational knowledge rather than generalized LLM summary.

The distinction drawn between different attack vectors (XSW vs. Golden SAML) and the specific procedural recommendations for response indicate an author actively synthesizing multiple research streams.