Executive brief
passport-wsfed-saml2 is a Node.js library that implements security authentication using the WSFed protocol. A vulnerability allows attackers who possess a signed authentication assertion from an identity provider to bypass authentication checks entirely, potentially gaining unauthorized access to protected resources. In some configurations, an attacker may not even need a valid user account to forge the required assertion.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the WSFed token signature validation logic of passport-wsfed-saml2 versions prior to 4.6.3. An attacker can bypass authentication by providing a malicious but IDP-signed WSFed assertion, exploiting a flaw in how the library validates signatures. The attack is network-accessible and requires no user interaction or prior authentication, though a valid IDP-signed assertion must be available; depending on the identity provider configuration, fully unauthenticated attackers might trigger assertion generation. The SAML2 protocol implementation in the same library is not affected. The fix is available in version 4.6.3.
Affected products
- Auth0 passport-wsfed-saml2 <4.6.3
Timeline
- 2022-12-13: disclosed
- 2022-12-13: patched: Version 4.6.3 released