Is CVE-2024-32962 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-32962 being exploited in the wild.

How severe is CVE-2024-32962?

Low severity, with a CVSS score of 3.1, published 1 May 2024.

Which products and versions are affected?

xml-crypto (npm) SEMVER:introduced=4.0.0,fixed=6.0.0.

Is there a fix for CVE-2024-32962?

Yes. xml-crypto (npm): upgrade to 6.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-32962 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-32962?

Check whether you run xml-crypto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-32962: node-saml xml-crypto XML signature verification bypass

CVE-2024-32962 · Severity: low · CVSS 3.1 · Published 2024-05-01

xml-crypto is a Node.js library used for digital signatures and encryption in XML documents, often used in authentication systems like SAML. A vulnerability in its default configuration allows attackers to bypass security checks by providing their own untrusted certificate within a malicious document. This could allow an attacker to spoof digital signatures, potentially leading to unauthorized access or the ability to submit fraudulent data that the system treats as authentic.

Technologies: xml-crypto (npm). Vendors: npm.

Quick answers

Is CVE-2024-32962 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-32962 being exploited in the wild.
How severe is CVE-2024-32962?: Low severity, with a CVSS score of 3.1, published 1 May 2024.
Which products and versions are affected?: xml-crypto (npm) SEMVER:introduced=4.0.0,fixed=6.0.0.
Is there a fix for CVE-2024-32962?: Yes. xml-crypto (npm): upgrade to 6.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-32962 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-32962?: Check whether you run xml-crypto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

xml-crypto (npm): upgrade to 6.0.0 or later
```
npm install xml-crypto@6.0.0
```

Technical details

The vulnerability exists in xml-crypto versions 4.x and 5.x due to the default behavior of the getCertFromKeyInfo method. By default, the library extracts and trusts any X509Certificate found in the <KeyInfo /> element of a signed XML document, even if a specific publicCert was explicitly configured for verification. An attacker can exploit this by re-signing a document with a malicious private key and attaching the corresponding certificate to the XML. The library will prefer the attacker-supplied certificate over the trusted one, resulting in a successful signature validation of a spoofed payload. This was addressed in version 6.0.0 by disabling the implicit usage of the default certificate extraction logic.

Affected products

node-saml xml-crypto >= 4.0.0, < 6.0.0

Identifiers

CVE-2024-32962
GHSA-2xp3-57p7-qf4v

Timeline

2023-06-17: other: Vulnerability introduced in version 4.0.0 via PR 301
2024-05-01: advisory: GitHub Security Advisory published
2024-05-01: patched: Fixed in version 6.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.