QID 377811

Date Published: 2022-12-15

QID 377811: Node-saml/passport-saml NPM Package Authentication Bypass Vulnerability (GHSA-m974-647v-whv7)

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml.

Affected Versions:
passport-saml versions prior to 3.2.2
node-saml versions prior to 4.0.0-beta.5

QID Detection Logic (Authenticated):
This QID checks for vulnerable version of passport-saml and node-saml npm package installed globally. The QID runs the "npm list -g --silent" command and also checks the file "/usr/local/lib/node_modules/passport-saml/package.json" and "/usr/local/lib/node_modules/node-saml/package.json" to look for vulnerable versions of passport-saml and node-saml.

Note:
NPM packages can be installed anywhere as a developer/production dependency. This QID can only detect passport-saml and node-saml packages that are installed globally. For Microsoft Windows, this QID checks for installed packages within the '%systemdrive%\Users\Administrator' directory.

A remote attacker may be able to bypass SAML authentication on a website using passport-saml.

  • CVSS V3 rated as Critical - 8.1 severity.
  • CVSS V2 rated as Medium - 5.1 severity.
    • Solution
    Customers are advised to refer Vendor Advisory for more information regarding this vulnerability.

    Vendor References

    CVEs related to QID 377811

    CVE-2022-39299 |
    Software Advisories
    Advisory ID Software Component Link
    GHSA-m974-647v-whv7 URL Logo github.com/advisories/GHSA-m974-647v-whv7
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].