Wildcard for HOST element in RequestMap

[Amit Thukral]

Hi,

For native SPs, applications configuration is picked up from RequestMapper
element from shibboleth2.xml. The sub-element tag HOST of a  RequestMap
defines application specific configuration for authentication,
authorization and application protection. The HOST element here CANNOT be a
wildcard character as per shibboleth2.xml configuration helps etc.

*This creates an issue where a possible attack vector where a nefarious
user can update their local system’s host-file to use a custom domain OR
simply navigate to the IP address of the https://<host-ip-address>/<url>.
Either of these options will allow for the application match NOT to be met
in shibboleth2.xml and thus, the SAML authentication requirement would be
skipped entirely.*

Had RequestMap element supported, the wildcard in the Host match, versus
the requirement that we have to specify a unique name. The above
vulnerability would not have existed. This creates the vulnerability that
ONLY protects any request to that specific URL.


Regards,

Amit Thukral
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20190814/23c72b0c/attachment.html>