In the standard SAML Web SSO flow with bearer assertions, where can an attacker steal the assertion?

At the user agent, where cross-site scripting can read the assertion as it passes through the browser, and on the way from the browser to the service provider, where a man-in-the-middle can capture it; because it is a bearer assertion, either attacker can replay it.

* The assertion travels through the browser, which is exactly where it is most exposed. *

The flow, step by step:

1. The user's browser (user agent) requests a protected resource from the service provider (SP). The SP has no security context; the user is not identified.
2. The SP answers with an <AuthnRequest>, which the browser
3. forwards to the identity provider (IdP).
4. The user authenticates at the IdP, which generates an assertion.
5. The IdP returns an <AuthnResponse> with the assertion to the browser,
6. which posts it to the SP. The SP verifies the assertion
7. and grants access (or returns an error).

The weak spots are steps 5 and 6, where the assertion sits in the browser and travels to the SP. Cross-site scripting (malicious JavaScript running in the page) can read it from the browser, and a man-in-the-middle on the browser-to-SP connection can intercept it. Since the SP accepts a bearer assertion from anyone, the stolen copy works for the attacker.

Go deeper:

• Security Assertion Markup Language: profiles (Wikipedia) — the Web Browser SSO profile and its bindings.
• Cross-site scripting (Wikipedia) — how injected scripts read data in the victim's browser.