GHSA-5wrg-8fxp-cx9r passport-wsfed-saml2 Signature Bypass vulnerability

Q: Which versions are affected by GHSA-5wrg-8fxp-cx9r?

2 open source packages ship an affected version, including passport-wsfed-saml2.

Q: Is GHSA-5wrg-8fxp-cx9r being exploited?

There is no known exploitation of GHSA-5wrg-8fxp-cx9r in the wild and no public exploit code.

Q: How do I fix GHSA-5wrg-8fxp-cx9r?

Upgrade passport-wsfed-saml2 to 3.0.10 or later.

Not scored Published 21 Jun 2023

An authenticated attacker can bypass SAML signature validation to modify assertion fields, potentially escalating privileges or altering user data.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-5wrg-8fxp-cx9r?

GHSA-5wrg-8fxp-cx9r is a vulnerability in passport-wsfed-saml2, published on 21 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Information

Please note that this is not a new disclosure, and is previously reported in our SECURITY-NOTICE.md which we removed in favor of github advisory.

Overview

A vulnerability was found in the validation of a SAML signature. The validation doesn't ensure that the "Signature" tag is at the proper location inside an "Assertion" tag. This leads to a signature relocation attack where the attacker can corrupt one field of data while maintaining the signature valid. This could allow an authenticated attacker to "remove" one group from the assertion or corrupt another field of an assertion.

Am I affected?

You are affected if you are using the passport-wsfed-saml2 library to version < 3.0.10

How do I fix it?

You may fix this issue by upgrading passport-wsfed-saml2 library to version 3.0.10 or above.

Will the fix impact my users?

This fix patches the library that your application runs, but will not impact your users, their current state, or any existing sessions.

Which versions are affected by GHSA-5wrg-8fxp-cx9r?