PT-2023-27307 · Node-Saml · Node-Saml

Jindazhao01 · Published 2023-08-21 · Updated 2023-09-05 · CVE-2023-40178

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Node-SAML versions prior to 4.0.5

Description The lack of checking of the current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an expired LogoutRequest. In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large scale.

Recommendations For versions prior to 4.0.5, update to version 4.0.5 to resolve the issue. As a temporary workaround, consider implementing additional timestamp validation for LogoutRequest XML to prevent reuse of expired requests. Restrict access to the validatePostRequestAsync() function in saml.js to minimize the risk of exploitation. Avoid using the NotOnOrAfter parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Verification of Cryptographic Signature

Insufficient Session Expiration

Weakness Enumeration

CWE-347

CWE-613

Related Identifiers

CVE-2023-40178

GHSA-VX8M-6FHW-PCCW

Affected Products

Node-Saml

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40178.json · Exploit
• https://github.com/node-saml/node-saml/commit/045e3b9c54211fdb95f96edf363679845b195cec · Patch
• https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vx8m-6fhw-pccw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40178 · Security Note
• https://github.com/node-saml/node-saml · Note
• https://github.com/node-saml/node-saml/releases/tag/v4.0.5 · Note
• https://t.me/cibsecurity/69095 · Telegram Post