~ / search / GHSA-8jjf-w7j6-323c

GHSA-8jjf-w7j6-323c

Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames

Source: GitHub Advisory Database (reviewed) High CVE-2017-1000452

Packages

EcosystemPackageAffectedFixed in
npm samlify < 2.4.0-rc5 2.4.0-rc5

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `samlify` prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider. ## Recommendation Upgrade to version 2.4.0-rc5 or later

References

External links from the advisory. They lead to third-party sites.