Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 21 June 2023.

Which products and versions are affected?

passport-wsfed-saml2 (npm) SEMVER:introduced=0,fixed=3.0.10.

Is there a fix for This vulnerability?

Yes. passport-wsfed-saml2 (npm): upgrade to 3.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run passport-wsfed-saml2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Auth0 passport-wsfed-saml2 SAML signature relocation bypass

Severity: info · Published 2023-06-21

Passport-wsfed-saml2 is a Node.js library that handles SAML authentication for web applications. An authenticated attacker can manipulate the location of the signature element in SAML assertions, allowing them to alter critical fields (such as group membership) while the signature remains valid. This could lead to privilege escalation or unauthorized access by circumventing intended security controls.

Technologies: passport-wsfed-saml2 (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 21 June 2023.
Which products and versions are affected?: passport-wsfed-saml2 (npm) SEMVER:introduced=0,fixed=3.0.10.
Is there a fix for This vulnerability?: Yes. passport-wsfed-saml2 (npm): upgrade to 3.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run passport-wsfed-saml2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

passport-wsfed-saml2 (npm): upgrade to 3.0.10 or later
```
npm install passport-wsfed-saml2@3.0.10
```

Technical details

The vulnerability is a signature relocation attack (CWE-347: Improper Verification of Cryptographic Signature) in SAML signature validation. The root cause is that the validation logic does not enforce that the Signature tag must appear in the correct position within the Assertion tag, allowing an attacker to move the signature element while maintaining cryptographic validity. An authenticated attacker can exploit this by crafting a malicious SAML response that relocates the signature, enabling field corruption—specifically removing group attributes or modifying other assertion data. Attack preconditions include authentication to the SAML identity provider and the ability to craft and send a modified SAML assertion. The fix, released in version 3.0.10, enforces proper signature location validation. Patches are available, and no active exploitation in the wild has been reported.

Affected products

Auth0 passport-wsfed-saml2 < 3.0.10

Timeline

2023-06-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.