Executive brief
Passport-wsfed-saml2 is a Node.js library that handles SAML authentication for web applications. An authenticated attacker can manipulate the location of the signature element in SAML assertions, allowing them to alter critical fields (such as group membership) while the signature remains valid. This could lead to privilege escalation or unauthorized access by circumventing intended security controls.
Technical details
The vulnerability is a signature relocation attack (CWE-347: Improper Verification of Cryptographic Signature) in SAML signature validation. The root cause is that the validation logic does not enforce that the Signature tag must appear in the correct position within the Assertion tag, allowing an attacker to move the signature element while maintaining cryptographic validity. An authenticated attacker can exploit this by crafting a malicious SAML response that relocates the signature, enabling field corruption—specifically removing group attributes or modifying other assertion data. Attack preconditions include authentication to the SAML identity provider and the ability to craft and send a modified SAML assertion. The fix, released in version 3.0.10, enforces proper signature location validation. Patches are available, and no active exploitation in the wild has been reported.
Affected products
- Auth0 passport-wsfed-saml2 < 3.0.10
Timeline
- 2023-06-21: disclosed