Description
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| krakenjs | passport-saml-encrypted | ≤ 0.1.13 | — |
References
- Reporter advisory: XML signature wrapping issue-tracking
- Signature located by an unconstrained XPath at v0.1.13 technical-description
- Assertion selected by a separate first-match XPath at v0.1.13 technical-description
- krakenjs/passport-saml-encrypted product
- VulnCheck Advisory: passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending third-party-advisory