QID 982292

QID 982292: Nodejs (npm) Security Update for saml2-js (GHSA-5p5w-j3g7-w4wv)

Versions of `saml2-js` prior to 1.12.4 or 2.0.2 are vulnerable to authentication bypass.

The `saml2-js` library may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Security Assertion Markup Language (SAML) is an XML-based markup language for security assertions regarding authentication and permissions, most commonly used for single sign-on (SSO) services.

Some XML DOM traversal and canonicalization APIs may be inconsistent in handling of comments within XML nodes. Incorrect use of these APIs by some SAML libraries results in incorrect parsing of the inner text of XML nodes such that any inner text after the comment is lost prior to cryptographically signing the SAML message. Text after the comment therefore has no impact on the signature on the SAML message.

A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider

## Recommendation

If you use 1.x upgrade to version 1.12.4 or greater
If you use 2.x upgrade to version 2.02 or greater

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as High - 7.5 severity.

Solution

Customers are advised to refer to GHSA-5p5w-j3g7-w4wv for updates pertaining to this vulnerability.

Vendor References

GHSA-5p5w-j3g7-w4wv - github.com/advisories/GHSA-5p5w-j3g7-w4wv

CVEs related to QID 982292

CVE-2017-11429 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-5p5w-j3g7-w4wv	saml2-js		github.com/advisories/GHSA-5p5w-j3g7-w4wv

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].