CVE-2022-39299: passport-saml signature bypass via multiple root elements

CVE-2022-39299 · Severity: low · CVSS 3.1 · Published 2022-10-12

passport-saml is a Node.js library that implements SAML authentication for web applications. An attacker in possession of an arbitrary IDP-signed XML element can bypass SAML authentication entirely, gaining unauthorized access to protected websites. In some configurations, this attack may require no prior valid user credentials.

Technologies: @node-saml/node-saml (npm), node-saml (npm), passport-saml (npm). Vendors: npm.

Quick answers

Is CVE-2022-39299 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-39299 being exploited in the wild.
How severe is CVE-2022-39299?
Low severity, with a CVSS score of 3.1, published 12 October 2022.
Which products and versions are affected?
@node-saml/node-saml (npm) SEMVER:introduced=0,fixed=4.0.0-beta.5; @node-saml/passport-saml (npm) SEMVER:introduced=0,fixed=4.0.0-beta.3; node-saml (npm) SEMVER:introduced=0,fixed=4.0.0-beta.5; passport-saml (npm) SEMVER:introduced=0,fixed=3.2.2.
Is there a fix for CVE-2022-39299?
Yes. @node-saml/node-saml (npm): upgrade to 4.0.0-beta.5 or later; @node-saml/passport-saml (npm): upgrade to 4.0.0-beta.3 or later; node-saml (npm): upgrade to 4.0.0-beta.5 or later; passport-saml (npm): upgrade to 3.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-39299 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2022-39299?
Check whether you run @node-saml/node-saml (npm), @node-saml/passport-saml (npm), node-saml (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @node-saml/node-saml (npm): upgrade to 4.0.0-beta.5 or later
    npm install @node-saml/node-saml@4.0.0-beta.5
  • @node-saml/passport-saml (npm): upgrade to 4.0.0-beta.3 or later
    npm install @node-saml/passport-saml@4.0.0-beta.3
  • node-saml (npm): upgrade to 4.0.0-beta.5 or later
    npm install node-saml@4.0.0-beta.5
  • passport-saml (npm): upgrade to 3.2.2 or later
    npm install passport-saml@3.2.2

Technical details

The vulnerability is a signature bypass (CWE-347) in SAML authentication libraries caused by improper XML parsing that fails to reject documents with multiple root elements. An attacker can craft a malicious SAML response containing an arbitrary IDP-signed XML element to forge authentication. The attack is network-reachable and requires no user interaction; however, the attacker must obtain or generate a valid IDP-signed XML element. Successful exploitation allows complete bypass of SAML authentication, granting unauthorized access to protected applications. Patches are available in passport-saml 3.2.2 and node-saml 4.0.0-beta.5 or later.

Affected products

  • node-saml passport-saml before 3.2.2
  • node-saml node-saml before 4.0.0-beta.5
  • node-saml @node-saml/node-saml before 4.0.0-beta.5
  • node-saml @node-saml/passport-saml before 4.0.0-beta.3

Identifiers

  • CVE-2022-39299
  • GHSA-m974-647v-whv7

Timeline

  • 2022-10-12: disclosed: Advisory published
  • 2022-10-12: patched: passport-saml 3.2.2 and node-saml 4.0.0-beta.5 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.