Search
Find a vulnerability
Search criteria
6 vulnerabilities by node_saml_project
CVE-2024-32962 (GCVE-0-2024-32962)
Vulnerability from nvd – Published: 2024-05-02 06:48 – Updated: 2025-02-13 17:52
VLAI
EPSS
VEX
Title
XML signature verification bypass due improper verification of signature / signature spoofing
Summary
xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional validation steps, the default configuration allows a malicious actor to re-sign an XML document, place the certificate in a `<KeyInfo />` element, and pass `xml-crypto` default validation checks. As a result `xml-crypto` trusts by default any certificate provided via digitally signed XML document's `<KeyInfo />`. `xml-crypto` prefers to use any certificate provided via digitally signed XML document's `<KeyInfo />` even if library was configured to use specific certificate (`publicCert`) for signature verification purposes. An attacker can spoof signature verification by modifying XML document and replacing existing signature with signature generated with malicious private key (created by attacker) and by attaching that private key's certificate to `<KeyInfo />` element. This vulnerability is combination of changes introduced to `4.0.0` on pull request 301 / commit `c2b83f98` and has been addressed in version 6.0.0 with pull request 445 / commit `21201723d`. Users are advised to upgrade. Users unable to upgrade may either check the certificate extracted via `getCertFromKeyInfo` against trusted certificates before accepting the results of the validation or set `xml-crypto's getCertFromKeyInfo` to `() => undefined` forcing `xml-crypto` to use an explicitly configured `publicCert` or `privateKey` for signature verification.
Severity
10 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-19 15:03 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/node-saml/xml-crypto/security/… | x_refsource_CONFIRM |
| https://github.com/node-saml/xml-crypto/pull/301 | x_refsource_MISC |
| https://github.com/node-saml/xml-crypto/pull/445 | x_refsource_MISC |
| https://github.com/node-saml/xml-crypto/commit/21… | x_refsource_MISC |
| https://github.com/node-saml/xml-crypto/commit/c2… | x_refsource_MISC |
| https://www.w3.org/TR/2008/REC-xmldsig-core-20080… | x_refsource_MISC |
| https://security.netapp.com/advisory/ntap-2024070… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| node-saml | xml-crypto |
Affected:
>= 4.0.0, < 6.0.0
|
|
| node_saml_project | xml_crypto |
Affected:
4.0.0 , < 6.0.0
(custom)
cpe:2.3:a:node_saml_project:xml_crypto:4.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:node_saml_project:xml_crypto:4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xml_crypto",
"vendor": "node_saml_project",
"versions": [
{
"lessThan": "6.0.0",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32962",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-19T15:03:41.921164Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-19T15:09:38.365Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:27:52.348Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v"
},
{
"name": "https://github.com/node-saml/xml-crypto/pull/301",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/node-saml/xml-crypto/pull/301"
},
{
"name": "https://github.com/node-saml/xml-crypto/pull/445",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/node-saml/xml-crypto/pull/445"
},
{
"name": "https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000"
},
{
"name": "https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca"
},
{
"name": "https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20240705-0003/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "xml-crypto",
"vendor": "node-saml",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 6.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional validation steps, the default configuration allows a malicious actor to re-sign an XML document, place the certificate in a `\u003cKeyInfo /\u003e` element, and pass `xml-crypto` default validation checks. As a result `xml-crypto` trusts by default any certificate provided via digitally signed XML document\u0027s `\u003cKeyInfo /\u003e`. `xml-crypto` prefers to use any certificate provided via digitally signed XML document\u0027s `\u003cKeyInfo /\u003e` even if library was configured to use specific certificate (`publicCert`) for signature verification purposes. An attacker can spoof signature verification by modifying XML document and replacing existing signature with signature generated with malicious private key (created by attacker) and by attaching that private key\u0027s certificate to `\u003cKeyInfo /\u003e` element. This vulnerability is combination of changes introduced to `4.0.0` on pull request 301 / commit `c2b83f98` and has been addressed in version 6.0.0 with pull request 445 / commit `21201723d`. Users are advised to upgrade. Users unable to upgrade may either check the certificate extracted via `getCertFromKeyInfo` against trusted certificates before accepting the results of the validation or set `xml-crypto\u0027s getCertFromKeyInfo` to `() =\u003e undefined` forcing `xml-crypto` to use an explicitly configured `publicCert` or `privateKey` for signature verification."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T16:05:57.815Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v"
},
{
"name": "https://github.com/node-saml/xml-crypto/pull/301",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-saml/xml-crypto/pull/301"
},
{
"name": "https://github.com/node-saml/xml-crypto/pull/445",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-saml/xml-crypto/pull/445"
},
{
"name": "https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000"
},
{
"name": "https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca"
},
{
"name": "https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240705-0003/"
}
],
"source": {
"advisory": "GHSA-2xp3-57p7-qf4v",
"discovery": "UNKNOWN"
},
"title": "XML signature verification bypass due improper verification of signature / signature spoofing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32962",
"datePublished": "2024-05-02T06:48:55.906Z",
"dateReserved": "2024-04-22T15:14:59.164Z",
"dateUpdated": "2025-02-13T17:52:18.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40178 (GCVE-0-2023-40178)
Vulnerability from nvd – Published: 2023-08-23 20:15 – Updated: 2024-10-02 18:56
VLAI
EPSS
VEX
Title
@node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError
Summary
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an expired LogoutRequest. In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large scale. This issue was patched in version 4.0.5.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-02 18:49 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/node-saml/node-saml/security/a… | x_refsource_CONFIRM |
| https://github.com/node-saml/node-saml/commit/045… | x_refsource_MISC |
| https://github.com/node-saml/node-saml/releases/t… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.555Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccw",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccw"
},
{
"name": "https://github.com/node-saml/node-saml/commit/045e3b9c54211fdb95f96edf363679845b195cec",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/node-saml/node-saml/commit/045e3b9c54211fdb95f96edf363679845b195cec"
},
{
"name": "https://github.com/node-saml/node-saml/releases/tag/v4.0.5",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/node-saml/node-saml/releases/tag/v4.0.5"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:node-saml:node-saml:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "node-saml",
"vendor": "node-saml",
"versions": [
{
"lessThan": "4.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40178",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-02T18:49:43.816412Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T18:56:08.820Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "node-saml",
"vendor": "node-saml",
"versions": [
{
"status": "affected",
"version": "\u003c 4.0.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an expired LogoutRequest. In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large scale. This issue was patched in version 4.0.5.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-23T20:15:23.057Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccw"
},
{
"name": "https://github.com/node-saml/node-saml/commit/045e3b9c54211fdb95f96edf363679845b195cec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-saml/node-saml/commit/045e3b9c54211fdb95f96edf363679845b195cec"
},
{
"name": "https://github.com/node-saml/node-saml/releases/tag/v4.0.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-saml/node-saml/releases/tag/v4.0.5"
}
],
"source": {
"advisory": "GHSA-vx8m-6fhw-pccw",
"discovery": "UNKNOWN"
},
"title": "@node-saml/node-saml\u0027s validatePostRequestAsync does not include checkTimestampsValidityError"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-40178",
"datePublished": "2023-08-23T20:15:23.057Z",
"dateReserved": "2023-08-09T15:26:41.052Z",
"dateUpdated": "2024-10-02T18:56:08.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-39300 (GCVE-0-2022-39300)
Vulnerability from nvd – Published: 2022-10-13 00:00 – Updated: 2025-04-23 16:50
VLAI
EPSS
VEX
Title
Signature bypass via multiple root elements in node-SAML
Summary
node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-23 15:47 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:00:43.991Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/node-saml/node-saml/security/advisories/GHSA-5p8w-2mvw-38pv"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/node-saml/node-saml/commit/c1f275c289c01921e58f5c70ce0fdbc5287e5fbe"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-39300",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T15:47:51.450082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T16:50:20.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "node-saml",
"vendor": "node-saml",
"versions": [
{
"status": "affected",
"version": "\u003c 4.0.0-beta.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-13T00:00:00.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/node-saml/node-saml/security/advisories/GHSA-5p8w-2mvw-38pv"
},
{
"url": "https://github.com/node-saml/node-saml/commit/c1f275c289c01921e58f5c70ce0fdbc5287e5fbe"
}
],
"source": {
"advisory": "GHSA-5p8w-2mvw-38pv",
"discovery": "UNKNOWN"
},
"title": "Signature bypass via multiple root elements in node-SAML"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-39300",
"datePublished": "2022-10-13T00:00:00.000Z",
"dateReserved": "2022-09-02T00:00:00.000Z",
"dateUpdated": "2025-04-23T16:50:20.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-32962 (GCVE-0-2024-32962)
Vulnerability from cvelistv5 – Published: 2024-05-02 06:48 – Updated: 2025-02-13 17:52
VLAI
EPSS
VEX
Title
XML signature verification bypass due improper verification of signature / signature spoofing
Summary
xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional validation steps, the default configuration allows a malicious actor to re-sign an XML document, place the certificate in a `<KeyInfo />` element, and pass `xml-crypto` default validation checks. As a result `xml-crypto` trusts by default any certificate provided via digitally signed XML document's `<KeyInfo />`. `xml-crypto` prefers to use any certificate provided via digitally signed XML document's `<KeyInfo />` even if library was configured to use specific certificate (`publicCert`) for signature verification purposes. An attacker can spoof signature verification by modifying XML document and replacing existing signature with signature generated with malicious private key (created by attacker) and by attaching that private key's certificate to `<KeyInfo />` element. This vulnerability is combination of changes introduced to `4.0.0` on pull request 301 / commit `c2b83f98` and has been addressed in version 6.0.0 with pull request 445 / commit `21201723d`. Users are advised to upgrade. Users unable to upgrade may either check the certificate extracted via `getCertFromKeyInfo` against trusted certificates before accepting the results of the validation or set `xml-crypto's getCertFromKeyInfo` to `() => undefined` forcing `xml-crypto` to use an explicitly configured `publicCert` or `privateKey` for signature verification.
Severity
10 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-19 15:03 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/node-saml/xml-crypto/security/… | x_refsource_CONFIRM |
| https://github.com/node-saml/xml-crypto/pull/301 | x_refsource_MISC |
| https://github.com/node-saml/xml-crypto/pull/445 | x_refsource_MISC |
| https://github.com/node-saml/xml-crypto/commit/21… | x_refsource_MISC |
| https://github.com/node-saml/xml-crypto/commit/c2… | x_refsource_MISC |
| https://www.w3.org/TR/2008/REC-xmldsig-core-20080… | x_refsource_MISC |
| https://security.netapp.com/advisory/ntap-2024070… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| node-saml | xml-crypto |
Affected:
>= 4.0.0, < 6.0.0
|
|
| node_saml_project | xml_crypto |
Affected:
4.0.0 , < 6.0.0
(custom)
cpe:2.3:a:node_saml_project:xml_crypto:4.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:node_saml_project:xml_crypto:4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xml_crypto",
"vendor": "node_saml_project",
"versions": [
{
"lessThan": "6.0.0",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32962",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-19T15:03:41.921164Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-19T15:09:38.365Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:27:52.348Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v"
},
{
"name": "https://github.com/node-saml/xml-crypto/pull/301",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/node-saml/xml-crypto/pull/301"
},
{
"name": "https://github.com/node-saml/xml-crypto/pull/445",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/node-saml/xml-crypto/pull/445"
},
{
"name": "https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000"
},
{
"name": "https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca"
},
{
"name": "https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20240705-0003/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "xml-crypto",
"vendor": "node-saml",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 6.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional validation steps, the default configuration allows a malicious actor to re-sign an XML document, place the certificate in a `\u003cKeyInfo /\u003e` element, and pass `xml-crypto` default validation checks. As a result `xml-crypto` trusts by default any certificate provided via digitally signed XML document\u0027s `\u003cKeyInfo /\u003e`. `xml-crypto` prefers to use any certificate provided via digitally signed XML document\u0027s `\u003cKeyInfo /\u003e` even if library was configured to use specific certificate (`publicCert`) for signature verification purposes. An attacker can spoof signature verification by modifying XML document and replacing existing signature with signature generated with malicious private key (created by attacker) and by attaching that private key\u0027s certificate to `\u003cKeyInfo /\u003e` element. This vulnerability is combination of changes introduced to `4.0.0` on pull request 301 / commit `c2b83f98` and has been addressed in version 6.0.0 with pull request 445 / commit `21201723d`. Users are advised to upgrade. Users unable to upgrade may either check the certificate extracted via `getCertFromKeyInfo` against trusted certificates before accepting the results of the validation or set `xml-crypto\u0027s getCertFromKeyInfo` to `() =\u003e undefined` forcing `xml-crypto` to use an explicitly configured `publicCert` or `privateKey` for signature verification."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T16:05:57.815Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v"
},
{
"name": "https://github.com/node-saml/xml-crypto/pull/301",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-saml/xml-crypto/pull/301"
},
{
"name": "https://github.com/node-saml/xml-crypto/pull/445",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-saml/xml-crypto/pull/445"
},
{
"name": "https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000"
},
{
"name": "https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca"
},
{
"name": "https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240705-0003/"
}
],
"source": {
"advisory": "GHSA-2xp3-57p7-qf4v",
"discovery": "UNKNOWN"
},
"title": "XML signature verification bypass due improper verification of signature / signature spoofing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32962",
"datePublished": "2024-05-02T06:48:55.906Z",
"dateReserved": "2024-04-22T15:14:59.164Z",
"dateUpdated": "2025-02-13T17:52:18.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40178 (GCVE-0-2023-40178)
Vulnerability from cvelistv5 – Published: 2023-08-23 20:15 – Updated: 2024-10-02 18:56
VLAI
EPSS
VEX
Title
@node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError
Summary
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an expired LogoutRequest. In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large scale. This issue was patched in version 4.0.5.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-02 18:49 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/node-saml/node-saml/security/a… | x_refsource_CONFIRM |
| https://github.com/node-saml/node-saml/commit/045… | x_refsource_MISC |
| https://github.com/node-saml/node-saml/releases/t… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.555Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccw",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccw"
},
{
"name": "https://github.com/node-saml/node-saml/commit/045e3b9c54211fdb95f96edf363679845b195cec",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/node-saml/node-saml/commit/045e3b9c54211fdb95f96edf363679845b195cec"
},
{
"name": "https://github.com/node-saml/node-saml/releases/tag/v4.0.5",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/node-saml/node-saml/releases/tag/v4.0.5"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:node-saml:node-saml:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "node-saml",
"vendor": "node-saml",
"versions": [
{
"lessThan": "4.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40178",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-02T18:49:43.816412Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T18:56:08.820Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "node-saml",
"vendor": "node-saml",
"versions": [
{
"status": "affected",
"version": "\u003c 4.0.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an expired LogoutRequest. In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large scale. This issue was patched in version 4.0.5.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-23T20:15:23.057Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccw"
},
{
"name": "https://github.com/node-saml/node-saml/commit/045e3b9c54211fdb95f96edf363679845b195cec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-saml/node-saml/commit/045e3b9c54211fdb95f96edf363679845b195cec"
},
{
"name": "https://github.com/node-saml/node-saml/releases/tag/v4.0.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-saml/node-saml/releases/tag/v4.0.5"
}
],
"source": {
"advisory": "GHSA-vx8m-6fhw-pccw",
"discovery": "UNKNOWN"
},
"title": "@node-saml/node-saml\u0027s validatePostRequestAsync does not include checkTimestampsValidityError"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-40178",
"datePublished": "2023-08-23T20:15:23.057Z",
"dateReserved": "2023-08-09T15:26:41.052Z",
"dateUpdated": "2024-10-02T18:56:08.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-39300 (GCVE-0-2022-39300)
Vulnerability from cvelistv5 – Published: 2022-10-13 00:00 – Updated: 2025-04-23 16:50
VLAI
EPSS
VEX
Title
Signature bypass via multiple root elements in node-SAML
Summary
node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-23 15:47 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:00:43.991Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/node-saml/node-saml/security/advisories/GHSA-5p8w-2mvw-38pv"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/node-saml/node-saml/commit/c1f275c289c01921e58f5c70ce0fdbc5287e5fbe"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-39300",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T15:47:51.450082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T16:50:20.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "node-saml",
"vendor": "node-saml",
"versions": [
{
"status": "affected",
"version": "\u003c 4.0.0-beta.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-13T00:00:00.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/node-saml/node-saml/security/advisories/GHSA-5p8w-2mvw-38pv"
},
{
"url": "https://github.com/node-saml/node-saml/commit/c1f275c289c01921e58f5c70ce0fdbc5287e5fbe"
}
],
"source": {
"advisory": "GHSA-5p8w-2mvw-38pv",
"discovery": "UNKNOWN"
},
"title": "Signature bypass via multiple root elements in node-SAML"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-39300",
"datePublished": "2022-10-13T00:00:00.000Z",
"dateReserved": "2022-09-02T00:00:00.000Z",
"dateUpdated": "2025-04-23T16:50:20.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}