SAML Signature Bypass in passport-saml-encrypted

Executive Summary

This vulnerability in passport-saml-encrypted through 0.1.13 allows attackers to bypass authentication by submitting unsigned SAML responses. The library only verifies SAML signatures if an optional certificate is configured, so omitting the cert option skips signature checks entirely. Attackers can forge unsigned SAML responses with arbitrary user details to gain authenticated access without valid signatures.

Useful 0 Not Useful 0

Detection Guidance

Check if your application uses passport-saml-encrypted version 0.1.13 or earlier by inspecting package.json or dependency files. Look for missing certificate configurations in SAML setup. Monitor authentication logs for unsigned SAML responses or unexpected user attributes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could impersonate any user, including administrators, by submitting forged SAML responses. This allows unauthorized access to sensitive data, privilege escalation, and complete compromise of authentication integrity. The attack requires no privileges or user interaction, only knowledge of the predictable assertion consumer service endpoint path.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability undermines authentication security, potentially violating compliance requirements for data protection and access control. GDPR and HIPAA mandate strong authentication and integrity protections for sensitive data. Bypassing authentication could lead to unauthorized access, data breaches, and non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to the latest version of passport-saml-encrypted if available. Ensure the cert option is mandatory in SAML configuration. Validate all SAML responses for signatures regardless of cert presence. Add strict input validation for SAML attributes.

Useful 0 Not Useful 0