SAML roulette: the hacker always wins

Introduction In this post, we’ll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Enterprise by exploiting the ruby-saml library

<hr>
<p><small>文章来源: <a href="https://portswigger.net/research/saml-roulette-the-hacker-always-wins" target="_blank">https://portswigger.net/research/saml-roulette-the-hacker-always-wins</a></small></p>