GitHub Advisoryadvisory · npm

GHSA-8jjf-w7j6-323c Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames

HIGH Published 2018-01-04 Modified 2023-08-18 Official page ↗
Aliases
CVE-2017-1000452
Ecosystem
npm
Packages
samlify
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-347, CWE-91
Reviewed
2020-06-16

Affected packages

• npm samlify: < 2.4.0-rc5 → fixed in 2.4.0-rc5

Description

Versions of `samlify` prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider. Recommendation Upgrade to version 2.4.0-rc5 or later

Related

Alias · CVE (1)

  • CVE-2017-1000452 An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers… vulnerability

Weakness · CWE (2)

  • CWE-347 Improper Verification of Cryptographic Signature weakness
  • CWE-91 XML Injection weakness

References