Description
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
krakenjs passport-saml-encrypted
Default version status: unaffected
0 to ≤ 0.1.13affected
pkg:npm/passport-saml-encryptedReferences
- https://github.com/krakenjs/passport-saml-encrypted/issues/30 ↗
- https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L256 ↗
- https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L328 ↗
- https://github.com/krakenjs/passport-saml-encrypted ↗
- https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-xml-signature-wrapping-via-assertion-prepending ↗