PT-2018-5219 · Samlify+1 · Samlify+1

Thijsschoonbrood · Published 2018-01-02 · Updated 2018-01-17 · CVE-2017-1000452

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions samlify versions prior to 2.4.0-rc5 Express-saml2 (affected versions not specified) samlify version 2.2.0 and earlier

Description An issue exists that could allow attackers to impersonate arbitrary users by modifying SAML content for a SAML service provider without invalidating the cryptographic signature. This may allow attackers to bypass primary authentication for the affected SAML service provider. The issue is due to the failure to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames.

Recommendations For samlify versions prior to 2.4.0-rc5, upgrade to version 2.4.0-rc5 or later. For Express-saml2, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to SAML service providers to minimize the risk of exploitation.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

CWE-91

Related Identifiers

CVE-2017-1000452

GHSA-8JJF-W7J6-323C

Affected Products

Express-Saml2

Samlify

References · 10

• https://github.com/tngan/samlify/releases/tag/v2.3.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000452 · Security Note
• https://osv.dev/vulnerability/GHSA-8jjf-w7j6-323c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000452 · Vendor Advisory
• https://github.com/tngan/samlify · Note
• https://github.com/tngan/samlify/commit/d382bbc7c6b8ea889839ae1f178730c25b09eb42 · Note
• https://github.com/tngan/samlify/releases/tag/v2.4.0-rc5 · Note
• https://github.com/tngan/samlify/compare/v2.4.0-rc4...v2.4.0-rc5 · Note
• https://whitehats.nl/blog/xml-signature-wrapping-samlify · Note
• https://hackerone.com/reports/356284 · Note