Vulnerability · Published Dec 13, 2022 · Assigned by GitHub_M
CVE-2022-23505Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication
Medium 5.3
In plain English
A medium-severity improper authentication in passport-wsfed-saml2 from auth0. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | passport-wsfed-saml2 | 4.6.3 | GHSA-ppjq-qxhx-m25f |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| auth0 | passport-wsfed-saml2 | < 4.6.3 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N