Threat Intelligence Database

XML::Sig versions 0.29 up to but not including 0.72 for Perl contain a vulnerability that allows signature verification to be bypassed. The verify function can return true even when no cryptographic signature or digest check is performed if all Signature elements are skipped due to certain conditions. This means untrusted XML documents may be accepted as valid without proper signature verification. Versions up to 0.28 are not affected as they use a different verification method.

XML::Sig versions before 0.71 for Perl contain a vulnerability that allows signature wrapping via duplicate ID values. The verification function resolves references by ID but only checks the first matching element, ignoring duplicates. This can cause a document with two elements sharing the same ID to verify successfully while an attacker controls the second element. In SAML2 contexts, this can lead to attacker control over the contents of an Assertion.

XML::Sig versions before 0.71 for Perl contain an XPath injection vulnerability in the ID lookup process. The vulnerability arises because the verify() and _get_signed_xml() functions build XPath expressions by concatenating unescaped URI values from the document, allowing injection of arbitrary XPath operators. This can cause the selection of unintended XML nodes for digest verification, potentially undermining signature validation.