PT-2022-24881 · Unknown+1 · Passport-Saml+1

Felix Wilhelm · Published 2022-10-12 · Updated 2023-03-01 · CVE-2022-39299

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Passport-SAML versions prior to 3.2.2 node-saml versions prior to 4.0.0-beta.5

Description A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks might also be feasible if generation of a signed message can be triggered.

Recommendations For Passport-SAML versions prior to 3.2.2, upgrade to version 3.2.2 or newer. For node-saml versions prior to 4.0.0-beta.5, upgrade to version 4.0.0-beta.5 or newer. As a temporary workaround, consider disabling SAML authentication until a patch is available.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2022-39299

DLA-3260-1

GHSA-M974-647V-WHV7

Affected Products

Passport-Saml

Node-Saml

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39299.json · Exploit
• 🔥 https://github.com/doyensec/CVE-2022-39299_PoC_Generator · Exploit
• https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e · Patch
• https://osv.dev/vulnerability/GHSA-m974-647v-whv7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39299 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39299 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3260-1 · Vendor Advisory
• https://github.com/node-saml/passport-saml · Note
• https://github.com/node-saml/passport-saml/releases/tag/v3.2.2 · Note
• https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7 · Note
• https://t.me/cibsecurity/52483 · Telegram Post
• https://t.me/cvenotify/42544 · Telegram Post
• http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.html · Note
• https://t.me/cvenotify/45258 · Telegram Post