CVE-2022-23505 Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication
Remote attackers can bypass WSFed authentication in passport-wsfed-saml2 by using arbitrary signed assertions, potentially gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23505?
CVE-2022-23505 is a medium-severity authentication bypass vulnerability in auth0 passport-wsfed-saml2, published on 13 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.
Weakness: CWE-287
Which versions are affected by CVE-2022-23505?
2 open source packages ship an affected version, including passport-wsfed-saml2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
passport-wsfed-saml2 npm | All versions | 4.6.3 |
passport-wsfed-saml2 npm | All versions | 4.6.3 |
Products include Auth0 Passport-Wsfed-Saml2.
How do I fix CVE-2022-23505?
Upgrade passport-wsfed-saml2 to 4.6.3 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-23505 being exploited?
There is no known exploitation of CVE-2022-23505 in the wild and no public exploit code.
Other vulnerabilities in auth0 passport-wsfed-saml2
Sources
Also known as GHSA-ppjq-qxhx-m25f.