GitHub Advisoryadvisory · npm

GHSA-m974-647v-whv7 Signature bypass via multiple root elements

HIGH Published 2022-10-12 Modified 2022-10-18 Official page ↗
Aliases
CVE-2022-39299
Ecosystem
npm
Packages
passport-saml, node-saml, @node-saml/node-saml, @node-saml/passport-saml
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-347
Reviewed
2022-10-12

Affected packages

• npm passport-saml: < 3.2.2 → fixed in 3.2.2 • npm node-saml: < 4.0.0-beta.5 → fixed in 4.0.0-beta.5 • npm @node-saml/node-saml: < 4.0.0-beta.5 → fixed in 4.0.0-beta.5 • npm @node-saml/passport-saml: < 4.0.0-beta.3 → fixed in 4.0.0-beta.3

Description

Impact A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Patches Users should upgrade to passport-saml 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before v4.0.0-beta.5. Workarounds Disable SAML authentication. References _Are there any links users can visit to find out more?_ For more information If you have any questions or comments about this advisory: • Open a discussion in the node-saml repo Credits • Felix Wilhelm of Google Project Zero

Related

Alias · CVE (1)

  • CVE-2022-39299 Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References