CVE-2021-39171 Unlimited transforms allowed for signed nodes
Attackers can cause denial of service by sending SAML payloads with unlimited transforms, consuming excessive system resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-39171?
CVE-2021-39171 is a medium-severity denial of service vulnerability in node-saml passport-saml, published on 27 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
Weakness: CWE-400
Which versions are affected by CVE-2021-39171?
2 open source packages ship an affected version, including passport-saml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
passport-saml npm | All versions | 3.1.0 |
passport-saml npm | All versions | 3.1.0 |
Products include Passport-Saml Project Passport-Saml.
How do I fix CVE-2021-39171?
Upgrade passport-saml to 3.1.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-39171 being exploited?
There is no known exploitation of CVE-2021-39171 in the wild and no public exploit code.
Other vulnerabilities in node-saml passport-saml
Sources
Also known as GHSA-5379-r78w-42h2.