CVE-2022-39300 Signature bypass via multiple root elements in node-SAML
Remote attackers can bypass SAML authentication in node-saml by exploiting signature validation flaws with multiple root elements.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39300?
CVE-2022-39300 is a high-severity authentication bypass vulnerability in node-saml, published on 13 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.
Weakness: CWE-347
Which versions are affected by CVE-2022-39300?
2 open source packages ship an affected version, including node-saml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
node-saml npm | All versions | 4.0.0-beta.5 |
node-saml npm | All versions | 4.0.0-beta.5 |
Products include Node Saml Project Node Saml.
How do I fix CVE-2022-39300?
Upgrade node-saml to 4.0.0-beta.5 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-39300 being exploited?
There is no known exploitation of CVE-2022-39300 in the wild and no public exploit code.
Other vulnerabilities in node-saml
Sources
Also known as GHSA-5p8w-2mvw-38pv.