Arp Spoofing with Saml

Arp Spoofing in SAML environments creates unique attack vectors that exploit the trust relationships between service providers and identity providers. Unlike traditional network-level ARP attacks, SAML ARP spoofing targets the metadata exchange and assertion handling processes.

The most common SAML ARP attack pattern involves intercepting SAML metadata exchanges between an IdP and SP. Attackers positioned on the same network can intercept the initial metadata request, replacing legitimate endpoints with malicious ones. This allows them to capture SAML assertions containing sensitive authentication data.

// Vulnerable SAML metadata endpoint exposure
const express = require('express');
const SamlStrategy = require('passport-saml').Strategy;

const app = express();

app.get('/saml/metadata', (req, res) => {
  res.type('application/xml');
  res.send(`
    <EntityDescriptor>
      <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                                  Location="https://vulnerable-app.com/saml/consume"
                                  index="0"
                                  isDefault="true"/>
      </SPSSODescriptor>
    </EntityDescriptor>
  `);
});

This exposed metadata endpoint becomes a target for ARP spoofing attacks. An attacker can intercept requests to this endpoint and return modified metadata containing malicious AssertionConsumerService URLs that redirect authentication flows to controlled infrastructure.

Another SAML-specific ARP vulnerability occurs during the SAML response handling phase. When SAML responses are transmitted over unencrypted channels, ARP spoofing can be used to intercept and modify the assertions before they reach the service provider:

// Vulnerable SAML response handling
app.post('/saml/consume', (req, res) => {
  const samlResponse = req.body.SAMLResponse;
  
  // No validation of response integrity or source
  const authnStatement = parseSAMLResponse(samlResponse);
  
  // Process authentication without verifying the response wasn't modified
  if (authnStatement) {
    req.session.user = authnStatement.subject;
    res.redirect('/dashboard');
  }
});

The absence of message integrity checks makes SAML responses susceptible to man-in-the-middle attacks facilitated by ARP spoofing. Attackers can modify the NameID, authentication context, or even inject entirely new assertions.

Detecting ARP spoofing in SAML environments requires monitoring both network-level and application-level indicators. Network monitoring tools can detect ARP cache poisoning attempts, but SAML-specific detection focuses on the application layer.

Key detection methods include monitoring SAML metadata exchanges for unexpected source addresses or timing anomalies. SAML responses should be validated for integrity using digital signatures, and any failures indicate potential tampering:

// SAML response integrity validation
const validateSAMLResponse = (samlResponse, expectedIssuer) => {
  try {
    const parser = new DOMParser();
    const xmlDoc = parser.parseFromString(samlResponse, 'text/xml');
    
    // Check digital signature
    const signature = xmlDoc.querySelector('ds:Signature');
    if (!signature) {
      throw new Error('Missing SAML signature');
    }
    
    // Validate issuer matches expected IdP
    const issuer = xmlDoc.querySelector('saml:Issuer').textContent;
    if (issuer !== expectedIssuer) {
      throw new Error('Unexpected SAML issuer');
    }
    
    // Verify signature using IdP's public key
    const isValid = verifyXMLSignature(xmlDoc, idpPublicKey);
    if (!isValid) {
      throw new Error('Invalid SAML signature');
    }
    
    return true;
  } catch (error) {
    console.warn('SAML validation failed:', error.message);
    return false;
  }
};

Automated scanning tools like middleBrick can identify SAML-specific ARP vulnerabilities by testing metadata endpoint exposure, validating SAML response handling, and checking for proper encryption in transit. The scanner examines SAML configurations for weak points that could be exploited through network-level attacks.

middleBrick's SAML security assessment includes testing for:

• Metadata endpoint exposure and configuration weaknesses
• SAML response validation and integrity checking
• Transport layer security for SAML communications
• Assertion encryption and signing requirements
• Session fixation vulnerabilities in SAML flows

The scanner provides a security score (A-F) with specific findings about ARP-related SAML vulnerabilities and actionable remediation steps.

Securing SAML implementations against ARP spoofing requires a defense-in-depth approach combining network security and application-level protections. The foundation is ensuring all SAML communications occur over encrypted channels with mutual authentication.

// Secure SAML configuration with proper validation
const secureSAMLSetup = () => {
  const samlStrategy = new SamlStrategy({
    // IdP configuration
    path: '/saml/consume',
    entryPoint: 'https://secure-idp.example.com/sso',
    issuer: 'https://app.example.com',
    
    // Strict validation settings
    validateInResponseTo: true,
    disableRequestedAuthnContext: false,
    
    // Certificate pinning for IdP
    cert: fs.readFileSync('idp-cert.pem'),
    
    // Force HTTPS for all SAML communications
    forceAuthn: true,
    allowUnauthorizedSSL: false,
    
    // Metadata security
    providerName: 'Secure SAML Service',
    serviceName: 'Secure Application',
    
    // Assertion encryption
    decryptionPvk: fs.readFileSync('sp-private-key.pem'),
    privateCert: fs.readFileSync('sp-cert.pem')
  }, (profile, done) => {
    // Validate SAML attributes before creating session
    if (!validateSAMLAttributes(profile)) {
      return done(new Error('Invalid SAML attributes'));
    }
    return done(null, profile);
  });
  
  return samlStrategy;
};

function validateSAMLAttributes(profile) {
  // Check for required attributes and valid values
  const requiredAttributes = ['email', 'role', 'department'];
  return requiredAttributes.every(attr => profile[attr]);
}

Network-level protections include implementing 802.1X authentication, DHCP snooping, and dynamic ARP inspection on network switches. These controls prevent ARP cache poisoning at the network layer before it can affect SAML communications.

Application-level defenses include:

• Metadata signing and validation to prevent endpoint tampering
• Assertion encryption to protect sensitive authentication data
• Response timing analysis to detect potential replay attacks
• IP address validation for SAML assertions when appropriate
• Multi-factor authentication to reduce the impact of compromised assertions

For enterprise deployments, consider implementing SAML security monitoring that tracks metadata changes, response validation failures, and authentication anomalies. This provides early warning of potential ARP spoofing attempts targeting your SAML infrastructure.

Regular security assessments using tools like middleBrick help identify configuration weaknesses before attackers can exploit them. The continuous monitoring capabilities in Pro and Enterprise plans ensure your SAML endpoints remain protected as your infrastructure evolves.