Executive brief
passport-saml is a Node.js library that handles SAML authentication for web applications. A flaw allows attackers to send malicious SAML payloads with excessive cryptographic transforms that consume significant CPU and memory resources during processing, enabling denial-of-service attacks that degrade or disable the authentication service.
Technical details
The vulnerability exists in passport-saml's SAML signature validation code, which processes XML Digital Signature (XMLDSIG) transforms without limiting their quantity. An attacker can craft a malicious SAML assertion containing an unlimited number of Transform elements within a Reference node, forcing the application to perform expensive cryptographic operations on each transform. This is an uncontrolled resource consumption vulnerability (CWE-400). The attack requires only network access and no authentication or user interaction. The fix, released in version 3.1.0, imposes a hard limit of 2 allowed transforms per signed node, preventing the resource exhaustion.
Affected products
- node-saml passport-saml before 3.1.0
Timeline
- 2021-08-27: disclosed: Security advisory published
- 2021-08-30: patched: Version 3.1.0 released with fix limiting transforms to 2