passport-saml@0.4.0 vulnerabilities

SAML 2.0 authentication strategy for Passport

  • latest version

    3.2.4

  • latest non vulnerable version

  • first published

    12 years ago

  • latest version published

    2 years ago

  • deprecated

    Package is deprecated

  • licenses detected

  • Direct Vulnerabilities

    Known vulnerabilities in the passport-saml package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Improper Verification of Cryptographic Signature

    passport-saml is an authentication provider for Passport, the Node.js authentication library.

    Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature by allowing a remote attacker to bypass SAML authentication on a website using passport-saml.

    Note A successful attack requires that the attacker is in possession of an arbitrary IDP-signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g, without access to a valid user) might also be feasible if the generation of a signed message can be triggered.

    How to fix Improper Verification of Cryptographic Signature?

    Upgrade passport-saml to version 3.2.2 or higher.

    <3.2.2
    • M
    Denial of Service (DoS)

    passport-saml is an authentication provider for Passport, the Node.js authentication library.

    Affected versions of this package are vulnerable to Denial of Service (DoS) via malicious SAML payloads that may consume excess system resources.

    How to fix Denial of Service (DoS)?

    Upgrade passport-saml to version 3.1.0 or higher.

    <3.1.0
    • M
    Authentication Bypass

    passport-saml is an authentication provider for Passport, the Node.js authentication library.

    Affected versions of this package are vulnerable to Authentication Bypass via the SAMLRequest parameter.

    How to fix Authentication Bypass?

    Upgrade passport-saml to version 1.0.0 or higher.

    <1.0.0