The esaml library and its forks, including dropbox esaml, are vulnerable to an XML External Entity (XXE) attack due to parsing SAML messages with xmerl_scan:string/2 before signature verification without disabling XML entity expansion. On Erlang/OTP versions before 27, xmerl allows XML entities by default, enabling an attacker to craft malicious SAML messages that cause the host to read local files and incorporate their contents into the SAML document. If the attacker is not a trusted SAML service provider, signature verification fails and the document is discarded, but sensitive file contents may still be exposed through logs or error messages. This vulnerability affects all versions of esaml on Erlang/OTP versions prior to 27. Erlang/OTP 27 and later are not affected due to a change in xmerl default behavior disabling entity expansion.

An attacker can exploit this vulnerability to read local files on the host system by embedding XML external entities in crafted SAML messages. This can lead to disclosure of sensitive information such as Kubernetes-mounted secrets. Although signature verification prevents acceptance of messages from untrusted sources, sensitive data may still be exposed in logs or error messages. There is also potential for server-side request forgery (SSRF) via crafted SAML messages. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity).

No official patch or fix is currently available for esaml itself. However, users running esaml on Erlang/OTP version 27 or later are not affected due to the default disabling of XML entity expansion in xmerl. Therefore, upgrading the Erlang/OTP runtime to version 27 or later effectively mitigates this vulnerability. Users should verify their Erlang/OTP version and consider upgrading accordingly. Additionally, avoid processing untrusted SAML messages before signature verification or disable XML entity expansion if possible. Patch status is not yet confirmed for esaml; check vendor advisories for updates.