Signature bypass via multiple root elements

高 8.1CVE-2022-39299 · GHSA-m974-647v-whv7 · 12/10/2022 公開 · 17/06/2026 更新

要点

CVE-2022-39299 は passport-saml (passport-saml project), @node-saml/node-saml, @node-saml/passport-saml に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：4.5%（全脆弱性の 91.5% より高い）。
対処：3.2.2, 4.0.0-beta.5, 4.0.0-beta.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
passport-saml passport-saml_project	`= 4.0.0< 3.2.2`	`3.2.2`
@node-saml/node-saml npm	`< 4.0.0-beta.5`	`4.0.0-beta.5`
@node-saml/passport-saml npm	`< 4.0.0-beta.3`	`4.0.0-beta.3`
node-saml npm	`< 4.0.0-beta.5`	`4.0.0-beta.5`
passport-saml npm	`< 3.2.2`	`3.2.2`

概要

Impact

A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.

Patches

Users should upgrade to passport-saml 3.2.2 or newer. The issue was also present in the beta releases of node-saml before v4.0.0-beta.5.

Workarounds

Disable SAML authentication.

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

Open a discussion in the node-saml repo

Credits

Felix Wilhelm of Google Project Zero

NVD の説明

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.