It appears to me that the sxip_in function implicitly trusts the email address that is returned from the user's homesite, and does no actual checking of which homesite the user is logging in from. Correct me if I'm wrong, but couldn't an attacker start their own homesite, create an account on it with a victim's email address, and use that to access the victim's account on any sxip.module-enabled drupal site? Shouldn't this be authenticating based on the combination of email and homesite the user is logging in with?

kevin

Comments

Andy Smith’s picture

Andy Smith commented

Once the module is updated to allow full SXIP support rather than just the simple protocol, this will not be a problem.

In SXIP, the chain of trust is such that it prevents a homesite from impersonating a user. When a user registers a homesite it has to be registered and have its certificate signed by the network registering agent, the root. When a user registers an account on a homesite, they, too, are passed through the root to gain an assertion concerning their email address.

When a site requests a verifiedEmail from a homesite, what it gets back is an xmlsec signed chunk of xml that says that the root has asserted this email address to belong to the user's gupi, within another xmlsec signed chunk of xml checksumming the data, saying that a valid homesite is sending the information, that it is a valid homesite for the given user by having had its cert signed by the root as well.

It is important to note here, that the root does not store any of the user's information, it simply acts as the registration agent for the network.

walkah’s picture

walkah commented
Status: Active » Fixed

this problem was fixed in 4.6 (by using the full MDK).

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)