| शीर्षक | krakenjs passport-saml-encrypted 0.1.13 xml signature wrapping |
|---|
| विवरण | validateResponse() performs signature verification and assertion-content extraction as two independent XPath lookups over the same document, each selecting the first matching node in document order, with no cross-check that the Assertion node whose attributes are trusted is the same node (or is covered by) the Signature that was verified. This is the classic XML Signature Wrapping (XSW) vulnerability class. An attacker who possesses any validly IdP-signed SAML message can insert an additional, unsigned, forged Assertion earlier in document order; the library reports the signature as valid (because a real signed assertion still exists in the document) while extracting attacker-controlled identity/attributes from the unsigned forged assertion instead. |
|---|
| स्रोत | ⚠️ https://github.com/krakenjs/passport-saml-encrypted/issues/30 |
|---|
| उपयोगकर्ता | Yu Bao from PayPal Cyber Security Team (UID 99838) |
|---|
| सबमिशन | 11/08/2026 04:56 AM (2 महीनों पहले) |
|---|
| संयम | 13/09/2026 05:49 PM (1 month later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 402181 [krakenjs passport-saml-encrypted तक 0.1.13 कमजोर प्रमाणीकरण] |
|---|
| अंक | 0 |
|---|