A critical signature wrapping vulnerability in the XML::Sig library allows unauthenticated attackers to bypass integrity checks by exploiting duplicate ID attributes.

The verify() function resolves URI references to XML nodes using an XPath expression that returns only the first matching element, failing to detect duplicate IDs. An attacker can supply a document where the signature validates the first element, while the application processes the second, malicious element.

This flaw can be leveraged to conduct signature wrapping attacks, particularly in SAML2 contexts, where an attacker can force an application to accept malicious assertions. With a CVSS score of 9.1, this vulnerability poses a severe threat to the trust model of any system relying on the integrity of signed XML documents.

Immediate Action: Upgrade to version 0.71 or higher, which includes fixes to correctly handle and validate unique identifiers.

Proactive Monitoring: Review logs for anomalous XML processing patterns or documents containing duplicate ID attributes that deviate from expected standards.

Compensating Controls: Implement secondary validation layers that enforce schema-level constraints, such as ensuring unique ID attributes before passing the document to the XML::Sig library.

Public Exploit Available: No

The vulnerability in XML::Sig is critical for applications that process signed XML data. Organizations should move quickly to update the library to version 0.71 to prevent potential identity spoofing and signature bypass attacks.