Is CVE-2017-1000452 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-1000452 being exploited in the wild.

How severe is CVE-2017-1000452?

Low severity, with a CVSS score of 3, published 4 January 2018.

Which products and versions are affected?

samlify (npm) SEMVER:introduced=0,fixed=2.4.0-rc5.

Is there a fix for CVE-2017-1000452?

Yes. samlify (npm): upgrade to 2.4.0-rc5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-1000452 attacked?

It is attacked over the network.

Am I affected by CVE-2017-1000452?

Check whether you run samlify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-1000452: Samlify authentication bypass via XML signature wrapping

CVE-2017-1000452 · Severity: low · CVSS 3 · Published 2018-01-04

Samlify is a library for handling SAML (Security Assertion Markup Language) authentication, commonly used by web applications to enable single sign-on. Versions before 2.4.0-rc5 contain a flaw that allows attackers to reuse SAML tokens with different usernames by wrapping XML signatures in a way that bypasses validation, potentially allowing unauthorized users to access systems using forged credentials.

Technologies: samlify (npm). Vendors: npm.

Quick answers

Is CVE-2017-1000452 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-1000452 being exploited in the wild.
How severe is CVE-2017-1000452?: Low severity, with a CVSS score of 3, published 4 January 2018.
Which products and versions are affected?: samlify (npm) SEMVER:introduced=0,fixed=2.4.0-rc5.
Is there a fix for CVE-2017-1000452?: Yes. samlify (npm): upgrade to 2.4.0-rc5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-1000452 attacked?: It is attacked over the network.
Am I affected by CVE-2017-1000452?: Check whether you run samlify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

samlify (npm): upgrade to 2.4.0-rc5 or later
```
npm install samlify@2.4.0-rc5
```

Technical details

The vulnerability is an XML Signature Wrapping attack (CWE-347, CWE-91) in Samlify's SAML token validation logic. The library fails to properly prevent signature wrapping, allowing an attacker to modify SAML content (such as the username/NameID) while preserving the cryptographic signature's validity. This occurs because the signature validation does not detect structural manipulation of the XML document. The attack is network-reachable and requires no authentication or user interaction. A remote attacker can craft a malicious SAML response and use it to impersonate any user in the system. The fix, released in version 2.4.0-rc5, adds stricter signature validation and wrapping attack detection.

Affected products

Samlify samlify prior to 2.4.0-rc5

Identifiers

CVE-2017-1000452
GHSA-8jjf-w7j6-323c

Timeline

2018-01-04: disclosed
2018-09-28: patched: Fix committed to repository

References

https://github.com/tngan/samlify/commit/d382bbc7c6b8ea889839ae1f178730c25b09eb42

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.