Is CVE-2022-23505 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-23505 being exploited in the wild.

How severe is CVE-2022-23505?

Low severity, with a CVSS score of 3.1, published 13 December 2022.

Which products and versions are affected?

passport-wsfed-saml2 (npm) SEMVER:introduced=0,fixed=4.6.3.

Is there a fix for CVE-2022-23505?

Yes. passport-wsfed-saml2 (npm): upgrade to 4.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-23505 attacked?

It is attacked over the network.

Am I affected by CVE-2022-23505?

Check whether you run passport-wsfed-saml2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-23505: passport-wsfed-saml2 signature bypass in WSFed authentication

CVE-2022-23505 · Severity: low · CVSS 3.1 · Published 2022-12-13

passport-wsfed-saml2 is a Node.js library that implements security authentication using the WSFed protocol. A vulnerability allows attackers who possess a signed authentication assertion from an identity provider to bypass authentication checks entirely, potentially gaining unauthorized access to protected resources. In some configurations, an attacker may not even need a valid user account to forge the required assertion.

Technologies: passport-wsfed-saml2 (npm). Vendors: npm.

Quick answers

Is CVE-2022-23505 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-23505 being exploited in the wild.
How severe is CVE-2022-23505?: Low severity, with a CVSS score of 3.1, published 13 December 2022.
Which products and versions are affected?: passport-wsfed-saml2 (npm) SEMVER:introduced=0,fixed=4.6.3.
Is there a fix for CVE-2022-23505?: Yes. passport-wsfed-saml2 (npm): upgrade to 4.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-23505 attacked?: It is attacked over the network.
Am I affected by CVE-2022-23505?: Check whether you run passport-wsfed-saml2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

passport-wsfed-saml2 (npm): upgrade to 4.6.3 or later
```
npm install passport-wsfed-saml2@4.6.3
```

Technical details

The vulnerability is an authentication bypass (CWE-287) in the WSFed token signature validation logic of passport-wsfed-saml2 versions prior to 4.6.3. An attacker can bypass authentication by providing a malicious but IDP-signed WSFed assertion, exploiting a flaw in how the library validates signatures. The attack is network-accessible and requires no user interaction or prior authentication, though a valid IDP-signed assertion must be available; depending on the identity provider configuration, fully unauthenticated attackers might trigger assertion generation. The SAML2 protocol implementation in the same library is not affected. The fix is available in version 4.6.3.

Affected products

Auth0 passport-wsfed-saml2 <4.6.3

Identifiers

CVE-2022-23505
GHSA-ppjq-qxhx-m25f

Timeline

2022-12-13: disclosed
2022-12-13: patched: Version 4.6.3 released

References

https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-ppjq-qxhx-m25f

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.