Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Low severity, with a CVSS score of 3, published 28 December 2017.
- Which products and versions are affected?
- passport-wsfed-saml2 (npm) SEMVER:introduced=0,fixed=3.0.5.
- Is there a fix for This vulnerability?
- Yes. passport-wsfed-saml2 (npm): upgrade to 3.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run passport-wsfed-saml2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- passport-wsfed-saml2 (npm): upgrade to 3.0.5 or later
npm install passport-wsfed-saml2@3.0.5
Technical details
The vulnerability (CWE-290: Improper Validation of Cryptographic Signature) occurs in passport-wsfed-saml2 versions before 3.0.5 when processing SAML responses that are not fully signed by the identity provider. An attacker can forge or modify SAML assertions, including only-asserted-signed responses, to impersonate legitimate users without valid credentials. The attack requires no authentication or user interaction and is network-accessible. The fix is available in version 3.0.5 and later.
Affected products
- Auth0 passport-wsfed-saml2 < 3.0.5
Timeline
- 2017-12-28: disclosed
- 2023-06-21: other: Advisory withdrawn as duplicate of GHSA-77fw-rf4v-vfp9