What is XML Signature Wrapping?

XML Signature Wrapping (XSW) is a flaw in processing signed XML. An attacker rearranges nodes or adds a second node so the cryptographic library still validates a legitimate signature while application logic uses a different element. The mathematics is correct; the binding between validation and use is broken.

Simplified pattern

<Response>
  <Assertion ID="attacker-controlled">
    <NameID>admin@example.test</NameID>
  </Assertion>
  <Wrapper>
    <Assertion ID="signed-original">
      <NameID>alice@example.test</NameID>
      <Signature>
        <Reference URI="#signed-original" />
      </Signature>
    </Assertion>
  </Wrapper>
</Response>

An unsafe application validates signed-original and then selects the first assertion using a broad XPath query. The example is deliberately simplified; real variants depend on schema, library and accepted structure.

Unsafe and safe processing principles

// Unsafe principle
verifyAnySignature(xmlDocument);
assertion = xmlDocument.findFirst("Assertion");
login(assertion.nameId);

// Safe principle
validatedElement = verifySignatureAndReturnReferencedElement(
    xmlDocument,
    trustedIdpCertificate
);
requireExactElementType(validatedElement, "Assertion");
validateSchemaAndSamlConditions(validatedElement);
login(validatedElement.nameId);

The exact node referenced and validated with a trusted key must be the node consumed. “The document contains a valid signature” is not enough.

Preventing XSW

• - Use maintained SAML/XML Signature libraries and patch them.
• - Validate against a narrow locally trusted schema and reject unexpected duplicates.
• - Treat IDs as XML IDs, require uniqueness and reject multiple unexpected assertions.
• - Trust only configured IdP certificates and allowed algorithms.
• - Pass the validated reference target directly to business logic; avoid a second XPath search.
• - Also validate issuer, audience, destination, time, InResponseTo and replay.

XSW versus XXE

XSW normally does not break cryptography. XXE concerns external entities during parsing. Both can affect the same SAML endpoint and require separate controls.

Useful open-source tools

SAML Raider helps analyze signed messages and create controlled wrapping variants. Add regression documents for the actual Service Provider. Code review remains decisive because a generic scanner cannot know which validated node the application later consumes.