要点
- CVE-2022-39300 は node saml (node saml project), node-saml に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.78%（全脆弱性の 56.0% より高い）。
- 対処：4.0.0, 4.0.0-beta.5 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| node saml | = 4.0.0< 4.0.0
| 4.0.0
|
| node-saml npm | < 4.0.0-beta.5
| 4.0.0-beta.5
|
概要
Impact
A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.
Patches
Users should upgrade to node-saml v4.0.0-beta5 or newer.
Workarounds
Disable SAML authentication.
References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
Credits
- Felix Wilhelm of Google Project Zero
NVD の説明
node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン