OneLogin SAML SSO Security & Risk Analysis

The 'onelogin-saml-sso' plugin v3.4.0 exhibits a mixed security posture. On one hand, the static analysis reveals a commendable absence of directly exposed entry points like AJAX handlers, REST API routes, or shortcodes without authentication. All SQL queries are properly prepared, and file operations are minimal. However, the output escaping is a significant concern, with 57% of outputs not being properly escaped, potentially leading to cross-site scripting (XSS) vulnerabilities.

The taint analysis shows one flow with unsanitized paths, which, while not classified as critical or high, still represents a potential risk for path traversal or information disclosure. The plugin's vulnerability history is concerning, with 5 known CVEs, including a past critical vulnerability related to improper authentication and others involving open redirects, XML entity expansion, and hard-coded credentials. The fact that the last known vulnerability was in 2021, and there are currently no unpatched CVEs, suggests that these past issues may have been addressed, but the historical pattern indicates a tendency for security weaknesses.

In conclusion, while the plugin has implemented some good security practices like prepared statements and limited attack surface, the poor output escaping and past vulnerability history present notable risks. The lack of critical or high severity findings in the current static and taint analysis is positive, but the historical context and the unescaped outputs warrant careful consideration and potential further investigation.