PT-2017-14626 · Auth0 · Passport-Wsfed-Saml2

Alan Bishop · Publicado 2017-12-23 · Atualizado 2023-06-21 · CVE-2017-16897

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Auth0 passport-wsfed-saml2 versions prior to 3.0.5

Description A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library, allowing an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response. This issue arises when the SAML identity provider either signs the SAML response and the assertion within it, or does not sign the SAML response but signs the assertion.

Recommendations To fix this vulnerability, upgrade the Auth0 passport-wsfed-saml2 library to version 3.0.5 or above. This fix patches the library without impacting users, their current state, or existing sessions.

Correção

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2017-16897

GHSA-77FW-RF4V-VFP9

GHSA-7FPW-CFC4-3P2C

Produtos afetados

Passport-Wsfed-Saml2

Referências · 9

• https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-77fw-rf4v-vfp9 · Nota
• https://github.com/auth0/passport-wsfed-saml2 · Nota
• https://github.com/auth0/passport-wsfed-saml2/commit/520b9fc0bb4249ce83bec47e30153419f086ab70 · Nota
• https://auth0.com/docs/security/bulletins/cve-2017-16897 · Aviso do Fabricante
• https://github.com/advisories/GHSA-7fpw-cfc4-3p2c · Nota
• https://osv.dev/vulnerability/CVE-2017-16897 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16897 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-7fpw-cfc4-3p2c · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-77fw-rf4v-vfp9 · Aviso do Fabricante