PT-2023-32981 · Unknown · Passport-Wsfed-Saml2
Published
2023-06-21
·
Updated
2023-06-21
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
passport-wsfed-saml2 versions prior to 3.0.10
Description
A vulnerability was found in the validation of a SAML signature, where the validation doesn't ensure that the
Signature tag is at the proper location inside an Assertion tag. This leads to a signature relocation attack, allowing an authenticated attacker to corrupt one field of data while maintaining the signature valid. The attacker could remove one group from the assertion or corrupt another field of an assertion.Recommendations
For versions prior to 3.0.10, upgrade the passport-wsfed-saml2 library to version 3.0.10 or above.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Passport-Wsfed-Saml2