The designer shall use both the <NotBefore> and <NotOnOrAfter> elements or <OneTimeUse> element when using the <Conditions> element in a SAML assertion.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22029	APP3920	SV-25355r1_rule	DCSQ-1	High

Description
When a SAML assertion is used with a <Conditions> element, a begin and end time for the <Conditions> element should be set to prevent reuse of the message at a later time. Not setting a specific time period for the <Conditions> element, the possibility exists of granting immediate access or elevated privileges to an attacker which result in an immediate loss of confidentiality. Any vulnerability associated with a DoD Information system or system enclave, the exploitation of which, by a risk factor, will directly and immediately result in loss of Confidentiality, Availability or Integrity of the system associated data.

Description

When a SAML assertion is used with a <Conditions> element, a begin and end time for the <Conditions> element should be set to prevent reuse of the message at a later time. Not setting a specific time period for the <Conditions> element, the possibility exists of granting immediate access or elevated privileges to an attacker which result in an immediate loss of confidentiality. Any vulnerability associated with a DoD Information system or system enclave, the exploitation of which, by a risk factor, will directly and immediately result in loss of Confidentiality, Availability or Integrity of the system associated data.

STIG	Date
Application Security and Development Checklist	2014-12-22

Details

Check Text ( C-27025r1_chk )
Examine the contents of a SOAP message using the element, all messages should contain the NotBefore and NotOnOrAfter or OneTimeUse element when in a SAML Assertion. This can be accomplished using a protocol analyzer such as WireShark 1) If SOAP using the element do not contain NotBefore and NotOnOrAfter or OneTimeUse elements, it is a finding.

Fix Text (F-23099r1_fix)
Implement the use of the NotBefore and NotOnOrAfter or OneTimeUse when using the Conditions element in a SAML assertion.