CVE-2017-1000452: Authentication Bypass in samlify
Summary
CVE-2017-1000452: Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames. Affects samlify versions < 2.4.0-rc5. Fixed in 2.4.0-rc5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
samlify is an npm package that provides SAML (Security Assertion Markup Language) functionality for Node.js applications. It allows developers to implement SAML service providers and identity providers. The package is widely used for integrating SAML-based authentication and authorization into web applications.
Vulnerability Detail
Versions of samlify prior to 2.3.0 are vulnerable to an Authentication Bypass. The package fails to prevent XML Signature Wrapping, which allows tokens to be reused with different usernames. This vulnerability enables a remote attacker to modify SAML content for a SAML service provider without invalidating the cryptographic signature. As a result, attackers may bypass primary authentication for the affected SAML service provider, gaining unauthorized access to protected resources.
How To Fix
Minimum fixed version
2.4.0-rc5
This is the first release that contains the fix.
npm install samlify@2.4.0-rc5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The samlify package prior to version 2.3.0 is vulnerable to an Authentication Bypass, allowing attackers to reuse tokens with different usernames. Upgrading to version 2.3.0 or later is recommended to fix this vulnerability. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for samlify →
FAQ
The vulnerability allows an attacker to bypass primary authentication for a SAML service provider, potentially gaining unauthorized access to protected resources.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using package-lock.json as a data source.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of the samlify package.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
For more information about this vulnerability, you can contact info@devnack.com. They can provide further support on vulnerability remediation.
Related vulnerabilities
Recent vulnerabilities recorded for samlify.
