GHSA-8gqj-226h-gm8r
Passport-wsfed-saml2 allows SAML Authentication Bypass via Attribute Smuggling
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | passport-wsfed-saml2 | >= 3.0.5, < 4.6.4 | 4.6.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Overview
This vulnerability allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done by adding attributes to the response.
### Am I Affected?
You are affected by this SAML Attribute Smuggling vulnerability if you are using `passport-wsfed-saml2` version 4.6.3 or below, specifically under the following conditions:
1. The service provider is using `passport-wsfed-saml2`,
2. A valid SAML Response signed by the Identity Provider can be obtained
### Fix
Upgrade to v4.6.4 or greater.
References
External links from the advisory. They lead to third-party sites.