GHSA-8jjf-w7j6-323c

    Dashboard / Vulnerabilities / GHSA-8jjf-w7j6-323c

    GHSA-8jjf-w7j6-323c

    Published: 4 Jan 2018Last Modified: 8 Nov 2023

    Summary: Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames

    Details: Versions of `samlify` prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider. ## Recommendation Upgrade to version 2.4.0-rc5 or later

    References: https://nvd.nist.gov/vuln/detail/CVE-2017-1000452, https://github.com/tngan/samlify/commit/d382bbc7c6b8ea889839ae1f178730c25b09eb42, https://hackerone.com/reports/356284, https://github.com/tngan/samlify, https://github.com/tngan/samlify/compare/v2.4.0-rc4...v2.4.0-rc5, https://github.com/tngan/samlify/releases/tag/v2.4.0-rc5, https://www.whitehats.nl/blog/xml-signature-wrapping-samlify

    Affected packages

    Package

    Name: samlify

    Purl: pkg:npm/samlify

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -2.4.0-rc5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High