Enterprise Salary Portal Compromise: Unauthorized Access to Employee Documents

The Discovery

Shortly after joining a large enterprise organization as an Associate Software Engineer, I began evaluating the security practices and technologies used across the company’s internal systems.

The organization followed established security practices, including SSO authentication, firewalls, code reviews, and other enterprise security controls. Because traditional external attack paths such as infrastructure scanning were not appropriate approaches, I focused on understanding the security boundaries of internal applications and third-party integrations.

While reviewing the employee salary management portal after receiving my first few paychecks, I noticed that the application was operated by a third-party provider and integrated with the company’s SSO system.

The authentication flow relied on SAML, where the company’s identity provider generated a SAML response after authentication. The third-party portal then consumed this response, validated it, and authenticated the user.

The Vulnerability

During analysis of the SAML authentication flow, I identified that the receiving application was not properly validating the SAML response signature.

Because the integrity of the SAML payload was not being verified, an attacker could potentially modify authentication data before submitting it to the portal.

Further investigation revealed that the payload contained a Base64-encoded username value. Since the username field was trusted without proper signature verification, modifying the identifier allowed me to impersonate another user.

This created an insecure direct object reference (IDOR)-style access control issue where changing the authenticated identity resulted in access to another employee’s account.

Impact

By exploiting this issue, I was able to access sensitive documents belonging to other employees through the salary portal, including documents belonging to highly privileged users within the organization.

The vulnerability affected the trust relationship between the enterprise identity provider and the third-party application. While the organization’s SSO infrastructure itself was functioning correctly, the downstream service incorrectly trusted unsigned authentication data.

The Fix

I documented the vulnerability and presented my findings to the internal security team.

I worked with the security team and coordinated with the third-party portal provider to communicate the technical details of the issue and support remediation efforts.

The resolution focused on ensuring that SAML responses were properly validated, including enforcing signature verification before accepting authentication claims.

Lessons Learned

This incident reinforced the importance of validating authentication boundaries across integrated systems.

Enterprise security controls such as SSO, firewalls, and secure development practices are only effective when every connected application correctly implements the expected security model.

Third-party integrations require the same level of security review as internally developed systems, especially when they handle sensitive employee information and rely on federated authentication protocols such as SAML.