PT-2019-7880 · Saml2-Js · Saml2-Js

Kelby Ludwig · Published 2019-04-17 · Updated 2019-10-09 · CVE-2017-11429

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions saml2-js versions prior to 1.12.4 saml2-js versions prior to 2.0.2

Description The issue arises from the incorrect utilization of XML DOM traversal and canonicalization APIs, allowing an attacker to manipulate SAML data without invalidating its cryptographic signature. This could potentially bypass authentication to SAML service providers. Security Assertion Markup Language (SAML) is used for security assertions regarding authentication and permissions, commonly in single sign-on (SSO) services. Some XML DOM traversal and canonicalization APIs handle comments within XML nodes inconsistently, leading to incorrect parsing of inner text in XML nodes. As a result, any inner text after a comment is lost before the SAML message is cryptographically signed, and thus has no impact on the signature. A remote attacker can modify SAML content without invalidating the signature, potentially allowing them to bypass primary authentication.

Recommendations If you use version 1.x, upgrade to version 1.12.4 or greater. If you use version 2.x, upgrade to version 2.0.2 or greater.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-11429

GHSA-5P5W-J3G7-W4WV

Affected Products

Saml2-Js

References · 7

• 🔥 https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations · Exploit
• https://osv.dev/vulnerability/GHSA-5p5w-j3g7-w4wv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11429 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11429 · Vendor Advisory
• https://npmjs.com/advisories/567 · Note
• https://kb.cert.org/vuls/id/475445 · Note
• https://github.com/advisories/GHSA-5p5w-j3g7-w4wv · Note