Executive brief
passport-wsfed-saml2 is a Node.js library that handles SAML2-based authentication for web applications. A signature verification flaw allows attackers to forge or tamper with SAML authentication tokens, bypassing identity verification and potentially impersonating other users or escalating privileges. This affects applications relying on this library for single sign-on authentication.
Technical details
The vulnerability is a signature bypass in SAML2 token validation (CWE-290), where the library fails to properly validate SAML response signatures under certain conditions, specifically when the identity provider signs the SAML assertion but either signs or does not sign the SAML response envelope. An unauthenticated attacker with network access can craft malicious SAML tokens to impersonate legitimate users. The vulnerability affects all versions prior to 3.0.5; the fix is available by upgrading to version 3.0.5 or later.
Affected products
- Auth0 passport-wsfed-saml2 < 3.0.5
Timeline
- 2023-06-21: disclosed
- 2023-06-21: patched: Version 3.0.5 released