Security issue in validate

[ghost]

Fairly sure that 'validate' should check that the ticket and service parameters match. Currently if once service gets a service ticket, it can then provide that ticket to another service and impersonate the user.

[ghost]

Surly the service is required to be the URL of the service hosting the
application by the fact that the login view redirects there. If you supply
an invalid URL the application would never get the service ticket in the
first place.

Consider the following:

1. You are logged into your applications via your CAS provider.
2. You are then browsing the web and come to my page.
3. My page uses an iframe to request your login supplying a new service
   URL.
4. My service URL receives a service ticket associated with your username.
5. I then use my browser to send that service ticket to your protected
   application.
6. Your application then validates the ticket and confirms I am in fact
   you!

If as I suggest validate checked that the ticket matched the service then
this impersonation would not be possible. If I used your service URL in
step 3 I could never get the ticket, and if I supplied my URL then the
validation would fail at step 6.

[AndreLouisCaron]

In case this applies to my earlier comment, I deleted it after re-checking the CAS specification because I had forgotten some details. You're right.

[AndreLouisCaron]

Note that if you can intercept the service ticket, it's likely you're also capable of intercepting the original service URL. Since the validation does not redirect, anyone can safely falsify the service URL during validation and use the intercepted service URL.

Validating that the service URL matches the original service URL only protects against the use case in which both of the following are true:

1. the attacker intercepted the HTTP response containing service ticker identifier, but not the HTTP request containing the service URL.
2. the attacker validates the service ticket before the application does

I agree that this should be fixed, but it's unlikely to be a real security issue.