Executive brief
The saml2-js library is used to implement SAML-based single sign-on (SSO) authentication in web applications. Due to improper handling of XML comments during signature verification, attackers can modify SAML authentication assertions without invalidating the cryptographic signature, potentially allowing them to bypass authentication and gain unauthorized access to protected systems.
Technical details
The vulnerability is a cryptographic signature bypass (CWE-287: Improper Authentication) affecting XML parsing in the saml2-js SAML library. The root cause is inconsistent handling of XML DOM traversal and canonicalization APIs when processing comments within XML nodes. When SAML assertions contain XML comments, the library incorrectly parses inner text, causing any content after the comment to be lost during signature computation. An attacker can craft a SAML response with malicious assertions preceded or followed by XML comments, allowing modification of authentication claims (e.g., user identity, roles) without triggering signature validation failures. The attack requires network access and the ability to intercept or control SAML responses, but does not require authentication. Patches are available: upgrade 1.x versions to 1.12.4 or later, and 2.x versions to 2.0.2 or later.
Affected products
- Clever saml2-js < 1.12.4, >= 2.0.0 and < 2.0.2
Timeline
- 2019-07-05: disclosed: GitHub Advisory GHSA-5p5w-j3g7-w4wv published
- 2018-02-27: other: VU#475445 originally released by CERT/CC