PT-2017-14626 · Auth0 · Passport-Wsfed-Saml2

Alan Bishop · Published 2017-12-23 · Updated 2023-06-21 · CVE-2017-16897

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Auth0 passport-wsfed-saml2 versions prior to 3.0.5

Description A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library, allowing an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response. This issue arises when the SAML identity provider either signs the SAML response and the assertion within it, or does not sign the SAML response but signs the assertion.

Recommendations To fix this vulnerability, upgrade the Auth0 passport-wsfed-saml2 library to version 3.0.5 or above. This fix patches the library without impacting users, their current state, or existing sessions.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2017-16897

GHSA-77FW-RF4V-VFP9

GHSA-7FPW-CFC4-3P2C

Affected Products

Passport-Wsfed-Saml2

References · 9

• https://auth0.com/docs/security/bulletins/cve-2017-16897 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16897 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16897 · Security Note
• https://osv.dev/vulnerability/GHSA-7fpw-cfc4-3p2c · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77fw-rf4v-vfp9 · Vendor Advisory
• https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-77fw-rf4v-vfp9 · Note
• https://github.com/auth0/passport-wsfed-saml2 · Note
• https://github.com/auth0/passport-wsfed-saml2/commit/520b9fc0bb4249ce83bec47e30153419f086ab70 · Note
• https://github.com/advisories/GHSA-7fpw-cfc4-3p2c · Note