CVE-2022-23505

Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-ppjq-qxhx-m25f	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:auth0:passport-wsfed-saml2:*:*:*:*:*:*:*:*

History

14 Jul 2023, 19:22

Type	Values Removed	Values Added
CWE	~~CWE-287~~	NVD-CWE-Other

15 Dec 2022, 21:05

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-12-13 08:15

Updated : 2024-02-04 23:14

NVD link : CVE-2022-23505

Mitre link : CVE-2022-23505

CVE.ORG link : CVE-2022-23505

JSON object : View

Products Affected

auth0

passport-wsfed-saml2

CWE

NVD-CWE-Other CWE-287

Improper Authentication

{"id": "CVE-2022-23505", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-12-13T08:15:09.067", "references": [{"url": "https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-ppjq-qxhx-m25f", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround."}, {"lang": "es", "value": "Passport-wsfed-saml2 es un protocolo ws-federation y un proveedor de autenticaci\u00f3n de tokens SAML2 para Passport. En versiones anteriores a la 4.6.3, un atacante remoto podr\u00eda eludir la autenticaci\u00f3n WSFed en un sitio web utilizando passport-wsfed-saml2. Un ataque exitoso requiere que el atacante est\u00e9 en posesi\u00f3n de una afirmaci\u00f3n arbitraria firmada por un IDP. Dependiendo del IDP utilizado, los ataques totalmente no autenticados (por ejemplo, sin acceso a un usuario v\u00e1lido) tambi\u00e9n podr\u00edan ser factibles si se puede activar la generaci\u00f3n de un mensaje firmado. Este problema se solucion\u00f3 en la versi\u00f3n 4.6.3. El uso de la autenticaci\u00f3n SAML2 en lugar de WSFed es un workaround."}], "lastModified": "2023-07-14T19:22:51.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:auth0:passport-wsfed-saml2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E8A3AEF-D586-4136-82E9-966CC3CDC5AE", "versionEndIncluding": "4.6.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}