In short
- CVE-2022-39300 is a HIGH (CVSS 8.1) vulnerability affecting node saml (node saml project), node-saml.
- Chance of exploitation in the next 30 days (EPSS): 0.78%, higher than 56.0% of all vulnerabilities.
- Fix: update to 4.0.0, 4.0.0-beta.5 or later.
| Package | Affected versions | Patched versions |
|---|
| node saml | = 4.0.0< 4.0.0
| 4.0.0
|
| node-saml npm | < 4.0.0-beta.5
| 4.0.0-beta.5
|
Description
Impact
A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.
Patches
Users should upgrade to node-saml v4.0.0-beta5 or newer.
Workarounds
Disable SAML authentication.
References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
Credits
- Felix Wilhelm of Google Project Zero
NVD description
node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free