Executive brief
passport-azure-ad is a Node.js authentication library that integrates Microsoft Azure Active Directory with Passport.js, enabling secure user login and identity verification. An authentication bypass vulnerability allows remote attackers to craft malicious tokens that bypass validation checks, gaining unauthorized access to applications using this library without proper credentials.
Technical details
This vulnerability is an authentication bypass (CWE-287) resulting from improper handling of the validateIssuer configuration setting. The affected library fails to properly validate the issuer claim in Azure AD tokens, allowing attackers to forge tokens with arbitrary issuers that are incorrectly accepted as valid. The vulnerability is network-reachable and requires no user interaction or authentication; an attacker simply sends a crafted token to trigger the bypass. The attack allows complete authentication bypass, potentially leading to unauthorized access to protected resources. Patches are available: version 1.x should update to 1.4.6 or later, and version 2.x should update to 2.0.1 or later.
Affected products
- Microsoft passport-azure-ad 1.0.0 to 1.4.5; 2.0.0
Timeline
- 2018-07-26: disclosed
- other: CVE-2016-7191 published (earlier disclosure date)