Is CVE-2022-39300 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-39300 being exploited in the wild.

How severe is CVE-2022-39300?

Low severity, with a CVSS score of 3.1, published 12 October 2022.

Which products and versions are affected?

node-saml (npm) SEMVER:introduced=0,fixed=4.0.0-beta.5.

Is there a fix for CVE-2022-39300?

Yes. node-saml (npm): upgrade to 4.0.0-beta.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-39300 attacked?

It is attacked over the network.

Am I affected by CVE-2022-39300?

Check whether you run node-saml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-39300: node-saml signature bypass via multiple root elements

CVE-2022-39300 · Severity: low · CVSS 3.1 · Published 2022-10-12

node-saml is a SAML authentication library used to secure sign-in for web applications. A flaw in how it validates XML signatures allows an attacker with an arbitrary IDP-signed XML element to bypass SAML authentication entirely, potentially logging in without valid credentials. Depending on the identity provider configuration, fully unauthenticated attacks may be possible.

Technologies: node-saml (npm). Vendors: npm.

Quick answers

Is CVE-2022-39300 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-39300 being exploited in the wild.
How severe is CVE-2022-39300?: Low severity, with a CVSS score of 3.1, published 12 October 2022.
Which products and versions are affected?: node-saml (npm) SEMVER:introduced=0,fixed=4.0.0-beta.5.
Is there a fix for CVE-2022-39300?: Yes. node-saml (npm): upgrade to 4.0.0-beta.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-39300 attacked?: It is attacked over the network.
Am I affected by CVE-2022-39300?: Check whether you run node-saml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-saml (npm): upgrade to 4.0.0-beta.5 or later
```
npm install node-saml@4.0.0-beta.5
```

Technical details

The vulnerability stems from improper XML signature validation in node-saml, where the library fails to properly check for multiple root elements in SAML response documents. An attacker who possesses an arbitrary identity provider (IDP)-signed XML element can craft a malicious SAML response with multiple root-level elements, causing the signature validation to pass while the authentication logic processes a different element than the one that was actually signed. This is a classic XML signature wrapping attack (CWE-347). The vulnerability requires possession of a valid IDP-signed XML element but may not require authentication if message generation can be triggered. The fix, released in node-saml v4.0.0-beta5, adds validation to ensure the signature applies to the entire document by checking that there is only one element child node in addition to the signature check itself.

Affected products

node-saml node-saml All versions prior to 4.0.0-beta.5

Identifiers

CVE-2022-39300
GHSA-5p8w-2mvw-38pv

Timeline

2022-10-12: disclosed: GHSA-5p8w-2mvw-38pv published
2022-10-11: patched: Fix merged in commit c1f275c; version 4.0.0-beta.5 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.