SAML Metadata URL SSRF: Turning IdP Config Into Server Fetches
Enterprise SSO admin panels love a convenience field: "Metadata URL." Paste a link, the app fetches XML, and certificates plus endpoints appear automatically. That fetch runs on the server. Guess who chooses the URL.
I treat every metadata import as an SSRF candidate until the egress controls prove otherwise.
Find the fetch
Look for SSO settings that accept a metadata URL rather than a file upload. Save the organization, watch the admin request, and see whether validation is synchronous. Some products fetch immediately; others queue a worker—blind SSRF still counts when your listener lights up.
Submit a HTTPS URL on an unused collaborator domain. A hit with a cloud provider user-agent or the application's egress IP confirms server-side retrieval. Check whether redirects are followed, whether file: or bare IPs are rejected, and whether DNS rebinding-style hostname changes are possible across retries.
Compare behavior for create versus update. I've seen create validate hosts while "refresh metadata" on an existing IdP follows redirects with a looser client.
Escalate without being reckless
A collaborator ping is often enough for a medium on many programs. Higher impact needs a careful next step inside policy: can the fetch reach a cloud metadata endpoint? An internal packaging host? A localhost admin port on the same machine?
Only attempt internal targets the program allows. Prefer reading a benign internal health endpoint over anything that changes state. If response bodies from the metadata fetch are echoed into the admin UI or error messages, you may get full response SSRF—much stronger than blind DNS.
XML parsing of the returned document can open a second bug class (XXE). Keep tests sequential: prove fetch first, then entity tricks on a document you host, never against someone else's infrastructure.
SAML-specific twists
Some apps re-fetch metadata on a schedule for certificate rotation. That turns a one-time SSRF into a recurring beacon—useful for proving persistence, risky if you leave a hostile URL saved. Clean up after yourself.
Entity ID and ACS URL fields sometimes trigger their own validation fetches. Test them separately; the metadata URL is only the loudest control. Unsigned metadata that still populates signing certificates into the trust store is an integrity problem adjacent to SSRF—call it out when the app accepts your attacker-controlled certs without pinning.
Writeup essentials
Include the admin setting path, the collaborator request headers, timing (sync vs async), and whether redirect chains worked. State clearly that you used a test tenant. Recommend allowlisting IdP hosts, fetching through a pinned egress proxy, blocking link-local and cloud metadata ranges, disabling redirects, and preferring manual XML upload with schema validation.
OWASP's SSRF overview helps non-SSO engineers understand why a "helpful" metadata import is a network-layer problem. Your job is to show the packet leaving their VPC because an IdP URL field said so. If the product supports metadata upload and URL import side by side, compare parsers. Upload-only hardening with a loose URL path is a common split-brain mistake.