Executive brief
node-saml is a SAML authentication library used to secure sign-in for web applications. A flaw in how it validates XML signatures allows an attacker with an arbitrary IDP-signed XML element to bypass SAML authentication entirely, potentially logging in without valid credentials. Depending on the identity provider configuration, fully unauthenticated attacks may be possible.
Technical details
The vulnerability stems from improper XML signature validation in node-saml, where the library fails to properly check for multiple root elements in SAML response documents. An attacker who possesses an arbitrary identity provider (IDP)-signed XML element can craft a malicious SAML response with multiple root-level elements, causing the signature validation to pass while the authentication logic processes a different element than the one that was actually signed. This is a classic XML signature wrapping attack (CWE-347). The vulnerability requires possession of a valid IDP-signed XML element but may not require authentication if message generation can be triggered. The fix, released in node-saml v4.0.0-beta5, adds validation to ensure the signature applies to the entire document by checking that there is only one element child node in addition to the signature check itself.
Affected products
- node-saml node-saml All versions prior to 4.0.0-beta.5
Timeline
- 2022-10-12: disclosed: GHSA-5p8w-2mvw-38pv published
- 2022-10-11: patched: Fix merged in commit c1f275c; version 4.0.0-beta.5 released