CVE-2017-16897 passport-wsfed-saml2 vulnerable to Signature Bypass in SAML2 token
Attackers can impersonate users and escalate privileges if the SAML identity provider does not sign the full response.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-16897?
CVE-2017-16897 is a high-severity authentication bypass vulnerability in n/a, published on 23 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).
Weakness: CWE-290
Which versions are affected by CVE-2017-16897?
2 open source packages ship an affected version, including passport-wsfed-saml2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
passport-wsfed-saml2 npm | All versions | 3.0.5 |
passport-wsfed-saml2 npm | All versions | 3.0.5 |
Products include Auth0 Passport-Wsfed-Saml2.
How do I fix CVE-2017-16897?
Upgrade passport-wsfed-saml2 to 3.0.5 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-16897 being exploited?
There is no known exploitation of CVE-2017-16897 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-77fw-rf4v-vfp9.