XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.
The vulnerability consists of improper implementation of XML signature verification (CWE-347 — improper verification of cryptographic signature). When the XML-Sig module receives an XML document without any signatures, it should return a validation error. In vulnerable versions, it returns true instead, meaning the document is treated as properly signed. An attacker can intentionally remove the signature from an XML document and then submit it to an application using the module — the verification result will be falsely positive.
An attacker can submit a forged or manipulated XML document that will pass signature validation, bypassing the integrity and authenticity verification mechanism. In systems based on SAML or other protocols using signed XML documents, this can lead to unauthorized access or impersonation of other users.
The XML-Sig module should be updated to a version higher than 0.67, in which the bug was fixed. Details are available in the project references on GitHub (issue #63, pull request #64). Until updating, consider implementing additional verification of signature presence before calling validation or temporarily disabling functionality based on this module.
Perl XML-Sig module (perl-XML-Sig) in versions 0.27 through 0.67 inclusive.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:NXml\ \
APPXml\sig_project
Related vulnerabilities
XPath injection w XML::Sig dla Perl — obejście weryfikacji podpisu XML
XML::Sig dla Perl – signature wrapping przez zduplikowane ID
XML::Sig dla Perl — pominięcie weryfikacji podpisu XML (signature bypass)
It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when pa...