Executive brief
saml2-js is a widely used library for SAML 2.0 authentication in Node.js applications, enabling secure single sign-on integration. The library failed to validate assertion conditions for encrypted SAML tokens, allowing attackers to indefinitely replay captured encrypted authentication assertions to impersonate legitimate users without needing the original credentials.
Technical details
The vulnerability is an authentication bypass (CWE-287) in saml2-js versions prior to 2.0.5, where assertion conditions are not enforced for encrypted assertions. The root cause is that condition validation occurs before decryption, failing to check temporal and audience constraints after decryption in parse_authn_response(). An attacker with network access can intercept an encrypted SAML assertion and reuse it indefinitely to bypass authentication. No authentication is required to exploit this; the attacker merely needs a captured encrypted token. The fix moves condition enforcement to after decryption and adds logic to validate conditions for encrypted assertions within signed messages. Version 2.0.5 or later resolves this issue.
Affected products
- Clever saml2-js prior to 2.0.5
Timeline
- 2020-09-03: disclosed
- 2019-10-16: patched: Fix merged in PR #190; version 2.0.5 released with fix