PT-2025-11287 · Unknown · Xml-Crypto

Published 2025-03-14 · Updated 2026-01-28 · CVE-2025-29774

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions xml-crypto versions prior to 6.0.1 xml-crypto versions prior to 3.2.1 xml-crypto versions prior to 2.1.6

Description The xml-crypto library for Node.js contains a vulnerability that allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. This could be used to alter critical identity or access control attributes, enabling an attacker with a valid account to escalate privileges or impersonate another user. The vulnerability can be exploited to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents.

Recommendations To resolve the issue, users of versions 6.0.0 and prior should upgrade to version 6.0.1. Users of versions 3.2.0 and prior should upgrade to version 3.2.1. Users of versions 2.1.5 and prior should upgrade to version 2.1.6. As a temporary workaround, consider implementing additional validation checks on signed XML messages to detect potential tampering. Restrict access to systems that rely on xml-crypto for verifying signed XML documents to minimize the risk of exploitation.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2025-04000

CVE-2025-29774

GHSA-9P8X-F768-WP2G

Affected Products

Xml-Crypto

References · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29774.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29774 · Security Note
• https://bdu.fstec.ru/vul/2025-04000 · Security Note
• https://osv.dev/vulnerability/GHSA-9p8x-f768-wp2g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29774 · Vendor Advisory
• https://github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed · Note
• https://github.com/node-saml/xml-crypto/releases/tag/v3.2.1 · Note
• https://github.com/node-saml/xml-crypto/releases/tag/v6.0.1 · Note
• https://github.com/node-saml/xml-crypto/releases/tag/v2.1.6 · Note
• https://github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07 · Note
• https://github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98 · Note
• https://github.com/node-saml/xml-crypto/security/advisories/GHSA-9p8x-f768-wp2g · Note
• https://github.com/node-saml/xml-crypto · Note
• https://t.me/cvetracker/19142 · Telegram Post
• https://t.me/cvedetector/20314 · Telegram Post