CVE-2017-11429: Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js
Summary
CVE-2017-11429: Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js. Affects saml2-js across 2 version ranges.
< 1.12.4
>= 2.0.0, < 2.0.2
Fixed in 1.12.4 or 2.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The saml2-js library is an npm package used for handling Security Assertion Markup Language (SAML) authentication and permissions. SAML is an XML-based markup language commonly used for single sign-on (SSO) services. The library versions prior to 1.12.4 or 2.0.2 are vulnerable to an authentication bypass vulnerability.
Vulnerability Detail
The vulnerability in saml2-js arises from incorrect utilization of XML DOM traversal and canonicalization APIs. This incorrect usage allows an attacker to manipulate SAML data without invalidating the cryptographic signature, potentially bypassing authentication to SAML service providers. The issue lies in the inconsistent handling of comments within XML nodes by some XML DOM traversal and canonicalization APIs. This inconsistency leads to incorrect parsing of the inner text of XML nodes, causing any inner text after a comment to be lost before cryptographically signing the SAML message. As a result, text after the comment has no impact on the signature, enabling a remote attacker to modify SAML content for a SAML service provider without invalidating the cryptographic signature and potentially bypassing primary authentication.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.12.41.12.4npm install saml2-js@1.12.4 -
>= 2.0.0, < 2.0.22.0.2npm install saml2-js@2.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The saml2-js library versions prior to 1.12.4 or 2.0.2 are vulnerable to an authentication bypass issue. Users should upgrade to the recommended versions to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for saml2-js →
FAQ
The vulnerability allows an attacker to potentially bypass primary authentication for affected SAML service providers.
SAML (Security Assertion Markup Language) is an XML-based markup language used for security assertions regarding authentication and permissions, commonly used for single sign-on (SSO) services.
The vulnerability arises from incorrect usage of XML DOM traversal and canonicalization APIs, resulting in inconsistent handling of comments within XML nodes.
To fix the vulnerability, upgrade to version 1.12.4 or greater if using the 1.x branch, and version 2.0.2 or greater if using the 2.x branch of saml2-js.
No, there is no known workaround for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for saml2-js.
