GitHub Enterprise Server SAML signature spoofing vulnerability

This repository contains a Python proof-of-concept exploit targeting SAML-based authentication systems. The main file, 'main.py', takes a base64-encoded SAML response and a target NameID as input. It decodes and parses the SAML XML, manipulates the XML structure to remove and re-insert signatures, alters assertion IDs, injects XML entities, and sets the NameID to an attacker-supplied value. The script then re-encodes the mutated SAML response, which can be used to attempt to bypass signature validation and impersonate arbitrary users in vulnerable SAML implementations. The exploit demonstrates a SAML signature bypass technique and is intended for testing or research purposes. The repository is minimal, containing only the exploit script and a placeholder README.

This repository contains a proof-of-concept exploit for CVE-2025-23369, targeting SAML service providers that use libxml2 for XML parsing. The exploit is implemented as a Ruby script (exploit.rb) that takes a Base64-encoded SAML response file and a target NameID as input. It decodes and parses the SAML response, manipulates the XML structure and signature elements, and injects XML entities to exploit quirks in libxml2's handling of XML signatures. The script then outputs a mutated, Base64-encoded SAML response that can be used to impersonate an arbitrary user if submitted to a vulnerable SAML service provider. The repository also includes a brief README with a link to a detailed write-up. No network endpoints or remote services are directly targeted by the script; it operates on local files and is intended to be used in scenarios where the attacker can submit the crafted SAML response to a vulnerable service.