CVE-2017-16897
passport-wsfed-saml2 vulnerable to Signature Bypass in SAML2 token
Impact
## Information Please note that this is not a new disclosure, and is previously reported in our [SECURITY-NOTICE.md](https://github.com/auth0/passport-wsfed-saml2/commit/520b9fc0bb4249ce83bec47e30153419f086ab70 ) which we removed in favor of github advisory. # Overview This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider: - signs SAML response and signs assertion - does not sign SAML response and signs assertion # Am I affected? You may be affected if you use SAML2 protocol with passport-wsfed-saml2 versions below 3.0.5 and your SAML identity Provider: 1. signs SAML response and signs assertion; or 2. does not sign SAML response and signs assertion # How do I fix it? You may fix this vulnerability by upgrading your library to version 3.0.5 or above. # Will the fix impact my users? This fix patches the library that your application runs, but will not impact your users, their current state, or any existing sessions.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | passport-wsfed-saml2 | < 3.0.5 | 3.0.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Auth0 | Passport-Wsfed-Saml2 | before 3.0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://auth0.com/docs/security/bulletins/cve-2017-16897
- https://github.com/advisories/GHSA-77fw-rf4v-vfp9
- https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-77fw-rf4v-vfp9
- https://nvd.nist.gov/vuln/detail/CVE-2017-16897
- https://github.com/auth0/passport-wsfed-saml2/commit/520b9fc0bb4249ce83bec47e30153419f086ab70