<div dir="ltr"><div dir="ltr">Thanks, both!</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, 10 Oct 2019 at 13:11, Robert Bradley <<a href="mailto:robert.bradley@it.ox.ac.uk">robert.bradley@it.ox.ac.uk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
On 10/10/2019 11:39, Max Spicer wrote:<br>
| Hi,<br>
|<br>
| It's come to my attention that our Shibboleth installation is<br>
| acting as as open redirect via the Logout endpoint. For example,<br>
| <a href="https://www.york.ac.uk/Shibboleth.sso/Logout?return=https://news.bbc.c" rel="noreferrer" target="_blank">https://www.york.ac.uk/Shibboleth.sso/Logout?return=https://news.bbc.c</a><br>
<a href="http://o.uk" rel="noreferrer" target="_blank">o.uk</a><br>
|<br>
|<br>
This could be used in phishing attacks to impersonate our domain.<br>
|<br>
| Is this behaviour standard, or is it a mis-configuration on our<br>
| part? How should we best mitigate this? One option might be to<br>
| simply disable this endpoint.<br>
|<br>
<br>
The short answer is possibly both: it's both the standard/default<br>
behaviour, and a potential mis-configuration depending on your point<br>
of view.  On version 2.5 of the SP and above, adding<br>
redirectLimit="exact" to the <Sessions/> element will mitigate the<br>
open redirect issue without needing to restart the Shibboleth<br>
daemon/service, with the full set of options documented at:<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/SP3/Sessions" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/SP3/Sessions</a><br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions</a><br>
<br>
Earlier versions lack support for this attribute, and will always<br>
perform open redirects.  That said, if your version of the SP software<br>
does not recognise the redirectLimit attribute, you'll want to upgrade<br>
in any case.<br>
<br>
- -- <br>
Dr Robert Bradley<br>
Identity and Access Management Team, IT Services, University of Oxford<br>
-----BEGIN PGP SIGNATURE-----<br>
<br>
iQIzBAEBCAAdFiEEgF3NFfO9FqlA+ME+lGGnynav474FAl2fH8oACgkQlGGnynav<br>
4776OA/+IyiOOTUyrnEP/iMgqBdPI1RszQCPXD+cQctRex7W54oTdAOYTEjTPpS6<br>
FP7JnCazIqvr3NgwsiCO8OekL2tTbgsCFBYu9APZuahBXW4fKus02fUzHYwq2OUM<br>
iCo2QVXvb1eNrn7InJvysSEc+2Eb9jMJ+uIChKYibdoHqdBqvn0CyW4FH/H6UX+X<br>
NhX5wQIzb5i1N+NpURSYO4QHvebpNyKN/axa6GyPa6ZktbrJirBSKXXfY4AZwB9g<br>
ms5dmJdHW+4PnSYmSdEq+w84w+ye2KBjBe7krJFMhqeLB3sos/bpML6zNWQo5yFf<br>
U7MXbpAg91YLBajlrpfcouQGYmPwThqZ7gfOawoRone4P1zuy89acHBoEkjiiP/a<br>
eT9+I+oQ4iJB9v8yjLo1ZaRto9mCCGu2iCSl0ZgqRGoRJgzy3aqi2Rnp5wM67Hwu<br>
UxeAKeXO3QNLUQeOLBkpcUjYS/G9bFuy+0qKuKnnQYuorm0mvm6bFJQ8c4gOGGwV<br>
7y1mCO8RxlYBqp8VvhbEllZ4WXVTzj0aOYFvdSs+/E5YC3B+aN5Tfny0ZZ8FIBJK<br>
vQHaoarZA3OGOUUXHrZKvGOWYC6eALbq2S8WcYxbj5rytPT+UJjplX4BZZcM7Cn5<br>
3za8xio2zFEwFNrPksfpIQA9JnxuujypwO0bdF2CgAdQWv32t5g=<br>
=bxEq<br>
-----END PGP SIGNATURE-----<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><div><br></div></div>