PT-2018-5219 · Samlify+1 · Samlify+1

Thijsschoonbrood · Publicado 2018-01-02 · Atualizado 2018-01-17 · CVE-2017-1000452

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions samlify versions prior to 2.4.0-rc5 Express-saml2 (affected versions not specified) samlify version 2.2.0 and earlier

Description An issue exists that could allow attackers to impersonate arbitrary users by modifying SAML content for a SAML service provider without invalidating the cryptographic signature. This may allow attackers to bypass primary authentication for the affected SAML service provider. The issue is due to the failure to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames.

Recommendations For samlify versions prior to 2.4.0-rc5, upgrade to version 2.4.0-rc5 or later. For Express-saml2, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to SAML service providers to minimize the risk of exploitation.

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

CWE-91

Identificadores relacionados

CVE-2017-1000452

GHSA-8JJF-W7J6-323C

Produtos afetados

Express-Saml2

Samlify

Referências · 10

• https://github.com/tngan/samlify · Nota
• https://github.com/tngan/samlify/commit/d382bbc7c6b8ea889839ae1f178730c25b09eb42 · Nota
• https://github.com/tngan/samlify/releases/tag/v2.4.0-rc5 · Nota
• https://github.com/tngan/samlify/compare/v2.4.0-rc4...v2.4.0-rc5 · Nota
• https://github.com/tngan/samlify/releases/tag/v2.3.0 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000452 · Nota de Segurança
• https://whitehats.nl/blog/xml-signature-wrapping-samlify · Nota
• https://hackerone.com/reports/356284 · Nota
• https://osv.dev/vulnerability/GHSA-8jjf-w7j6-323c · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1000452 · Aviso do Fabricante