Connect with us
ANE Scholarship
Categories:
X

Technology

Passport-SAML auth bypass triggers fix of critical, upstream XMLDOM problem

Published

on

Passport-SAML auth bypass triggers fix of critical, upstream XMLDOM problem
Share this post:

A critical vulnerability arising from improper input validation has been addressed in XMLDOM, the JavaScript implementation of W3C DOM for Node.js, Rhino, and browsers.

The flawed behavior was seemingly first flagged as potentially in need of remedy in 2016. But it was only with the recent discovery of an authentication bypass in Passport-SAML, the SAML 2.0 authentication provider for Node.js library Passport, that XMLDOM maintainers tackled the root cause of the problem.

“Xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or throwing,” an XMLDOM advisory published on November 1 explained.

Breaking the assumption

“This breaks the assumption that there is only a single root node in the tree,” it continues, and poses “a potential issue for dependents”.

The bug was assigned CVE-2022-39353 and a severity rating of CVSS 9.4 by GitHub CVE Numbering Authority, later uprated in severity to CVSS 9.8 by the NIST National Vulnerability Database.

XMLDOM is widely used, with NPM detecting 2.8 million weekly downloads (albeit caveats apply regarding the accuracy of download counts).

Kurt Boberg, a maintainer on the project, told The Daily Swig: “Any security-critical workflow that accepts partial signatures on XML and reads a child node is likely affected by this issue.

“The core problem is that you can supply two XML documents to a request (one valid, one forged) and as long as the validator accepts the legitimate one, a property read via xmldom can potentially read a node value out of the forged document.”

Passport-SAML bypass

Passport-SAML, which has 167,000 weekly NPM downloads, mishandled cryptographic signature verification because of the XMLDOM flaw. Tracked as CVE-2022-39299, the high severity Passport-SAML issue potentially enabled an attacker “to bypass SAML authentication on a website using passport-saml,” The CVE description said.

“A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.”

The bug, assigned a severity score of CVSS 8.1, was patched on October 11.

‘Worst possible outcome’

Asked what other damage an attacker might potentially cause downstream of the XMLDOM bug, Boberg said it “really depends on the expectations around the XML parsing. The aforementioned SAML issue is pretty much the worst possible outcome.

“It really hinges on the parsing application making a security decision based on XML input from the user that it expects to be signed. It’s like stapling an additional page to a notarized document, and passing it through a verification process that only checks if the first page is notarized.”

He added: “The downstream impact depends entirely on what the legitimate document would let you do.”

Path to a patch

The related GitHub bug thread began in 2016, when an XMLDOM maintainer said the issue “appears to me to be a violation of the W3C DOM Level 2 Core Specification”.

Speculating that the flaw “might be a ‘false-positive’ bug”, he suggested “there is some utility in being able to parse multiple documents in a single stream, if the API can be re-tooled just a bit”. He also described doing so “silently without issuing even so much as a warning to consumers” as “odd”.

The thread then remained dormant until the emergence of the Passport-SAML vulnerability and its root cause quickly became apparent, prompting the rapid deployment of patches within @xmldom/xmldom NPM versions 0.7.7, 0.8.4, and 0.9.0-beta.4, together with mitigations, fix details, and advice to developers to align with the specs to avoid code breakage.


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment

Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Lionel Messi et World Cup _ AllNaijaEntertainemnt
Sports5 hours ago

All Time Argentina’s Top Goal Scorer At The FIFA World Cup

DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022
Entertainment5 hours ago

Will There Be Wednesday (Tv Series) Season 2, Release Date, Cast, Latest News

Fernando Santos has hit out at Cristiano Ronaldo for his reaction to being substituted
Sports6 hours ago

Portugal Coach Fire-back at Ronaldo For Sub Reaction

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories6 hours ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 22)

Behind The Fine Face by Moshood Avidiime - ANE Story
ANE Stories6 hours ago

[STORY] BEHIND THE FINE FACE (Episode 08)

Entertainment7 hours ago

Actress, Keke Palmer announces pregnancy during ‘Saturday Night Live’

News7 hours ago

2023: Time to liberate yourself, vote out APC – Atiku to Lagosians

News7 hours ago

2023: INEC to meet NCC, telcos, on Tuesday

Sports7 hours ago

FIFA World Cup 2022: Croatia beat Japan on penalties to reach World Cup quarter-finals

GraphQL password hash leak problem fixed in Ibexa DXP
Technology9 hours ago

GraphQL password hash leak problem fixed in Ibexa DXP

Chief Dennis Ekpe Ogbu
News9 hours ago

Gunmen kidnap Benue Commissioner for Housing

News9 hours ago

Adeleke threatens to penalize MDAs, starts payment of salaries

Atiku Abubakar
News9 hours ago

FG slams Atiku, ‘You live in Dubai’, you don’t really know Nigeria

Bola Tinubu
News9 hours ago

Tinubu criticizes Arise TV, claiming they wish to profit from him

Bola Tinubu
News10 hours ago

Tinubu Speaks about the debate surrounding his birth certificate and birth date

Singer AV drops highly anticipated debut EP, 'Thug Love'
Entertainment10 hours ago

Singer AV drops highly anticipated debut EP, ‘Thug Love’

I'm disappointed – Blaqbonez reacts to Wizkid's comments
Entertainment10 hours ago

I’m disappointed – Blaqbonez reacts to Wizkid’s comments

News11 hours ago

South Africa parliament to vote on Ramaphosa’s impeachment Tuesday

Education11 hours ago

OAU to graduate 5,852 students, 130 bag first class

News11 hours ago

Oseni: “If I Am To Start With Him, Reno Will Not Exist” – Reno Shares New Audio

Lai Mohammed
News11 hours ago

Atiku has no moral basis to criticise Buhari — Lai Mohammed

News11 hours ago

Elon Musk says risk of him being assassinated is ‘quite significant’

Bitcoin
Technology15 hours ago

Variation in the Types of Cryptocurrencies

Bitcoin
Technology15 hours ago

Factors To Consider Before Choosing Bitcoin Exchange

Bitcoin
Technology16 hours ago

Things You Should Know About Bitcoin Statistics: Future Trends

Bitcoin Cryptocurrency
Technology16 hours ago

Bitcoin For Beginners: An Informative Report On The Digital Currency

News16 hours ago

Oil can’t feed Nigeria anymore – Obasanjo

Sesame Street Icon, Bob McGrath Dies At 90
News16 hours ago

Sesame Street Icon, Bob McGrath Dies At 90

Sigourney Weaver
Entertainment20 hours ago

Sigourney Weaver channelled her own teenage self into role 14-year-old Na’vi Kiri in Avatar: The Way of Water

Kate Winslet was ‘traumatised’ by Titanic – James Cameron
Entertainment20 hours ago

Kate Winslet was ‘traumatised’ by Titanic – James Cameron

Jude Bellingham defends Liverpool star after England win
Sports20 hours ago

Jude Bellingham defends Liverpool star after England win

Gilberto Silva promises to speak to Edu about signing England star
Sports20 hours ago

Gilberto Silva promises to speak to Edu about signing England star

Harry Kane praises team’s mentality after beating Senegal
Sports20 hours ago

Harry Kane praises team’s mentality after beating Senegal

Chelsea confirm signing of Raheem Sterling from Manchester City
Sports21 hours ago

Raheem Sterling to leave England’s World Cup camp after armed robbery

Horoscope21 hours ago

Your daily horoscope for Monday, December 5, 2022

Oil Petroleum
News1 day ago

NNPC not sincere about oil theft, exaggerating figures – Navy

Sports1 day ago

FIFA World Cup 2022: Giroud and Mbappe break records as France reach World Cup quarter-finals

News1 day ago

“I Owe No One Apology For Commending Buhari”: Wike To PDP Members

News1 day ago

NCC Reveals List Of Unapproved Phones In Nigerian Markets To Be Avoided

News2 days ago

Greetings flow in as Buhari and Aisha celebrate 33 years of marriage

DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022
Movie Subtitle4 days ago

DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022

Troll (2022 film)
Movie Subtitle3 days ago

DOWNLOAD Complete Troll (2022 film) Subtitles File [English SRT] 2022

My Name Is Vendetta (2022 film)
Movie Subtitle3 days ago

DOWNLOAD Complete My Name Is Vendetta (2022 film) Subtitles File [English SRT] 2022

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Complete Episodes)

Behind The Fine Face by Moshood Avidiime - ANE Story
ANE Stories7 days ago

[STORY] BEHIND THE FINE FACE (Complete Episodes)

Timaya
Music7 days ago

[Music] Timaya – Sweet Us (As e Dey Sweet Us e Dey Pain Dem)

Kim Kardashian Butt
Celebrity7 days ago

Top 10 Celebrities With Brazilian Butt Lift Surgery (BBL) [PHOTOS]

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Episode 06)

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Episode 07)

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Episode 01)

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Episode 02)

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Episode 12)

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Episode 05)

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Final Episode 13)

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Episode 04)

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Episode 10)

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Episode 03)

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Episode 08)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories3 days ago

[STORY] DIARY OF A PASTOR’S SON (Complete Episodes)

Horoscope5 days ago

Your daily horoscope for Thursday, December 1, 2022

Behind The Fine Face by Moshood Avidiime - ANE Story
ANE Stories7 days ago

[STORY] BEHIND THE FINE FACE (Episode 01)

Aunty Success
Celebrity4 days ago

Top 5 Richest Kid Nigerian Skit Makers And How Their Networth

Behind The Fine Face by Moshood Avidiime - ANE Story
ANE Stories7 days ago

[STORY] BEHIND THE FINE FACE (Episode 04)

Sven-Goran Eriksson
Sports4 days ago

Who Manchester United should sign instead of Cody Gakpo – Sven-Goran Eriksson

Kehlani Goes Viral After Flirting With Underage Girl At Concert
Celebrity7 days ago

Kehlani Goes Viral After Flirting With Underage Girl At Concert

Behind The Fine Face by Moshood Avidiime - ANE Story
ANE Stories7 days ago

[STORY] BEHIND THE FINE FACE (Episode 02)

Blood & Water (South African TV series)
Movie Subtitle3 days ago

DOWNLOAD Complete Blood & Water (TV series) (2022 film) Season 3 Subtitles File [English SRT] 2022

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Episode 11)

Behind The Fine Face by Moshood Avidiime - ANE Story
ANE Stories7 days ago

[STORY] BEHIND THE FINE FACE (Episode 03)

Antony marked his Manchester United debut with a well-taken goal against Arsenal on Sunday, becoming the first Brazilian to score on his Premier League bow for the club. The winger, who arrived from Ajax in an £81.3million (€95m) deal, latched onto Marcus Rashford’s well-timed pass to slot home after 35 minutes, handing the Red Devils a 1-0 lead at Old Trafford. Antony became the ninth Brazilian player to appear for United in the Premier League. At the age of 22 years and 192 days, Antony’s goal made him the youngest Brazilian to score on his Premier League debut for any team. Casemiro became the eighth Brazilian to appear for United in the competition last month after joining from Real Madrid, but the midfielder is still awaiting his first start for the club. Antony was United’s most costly addition in a busy transfer window, having joined the likes of Christian Eriksen, Tyrell Malacia, Lisandro Martinez, Casemiro and Martin Dubravka in making the switch to Old Trafford.
Sports6 days ago

Antony blames Qatar’s air conditioning for World Cup illness

The Virgin Wife - ANE Story
ANE Stories7 days ago

[STORY] THE VIRGIN WIFE (Episode 09)

Timaya
Lyrics7 days ago

Timaya – Sweet Us [Lyrics]

Behind The Fine Face by Moshood Avidiime - ANE Story
ANE Stories4 days ago

[STORY] BEHIND THE FINE FACE (Episode 05)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories4 days ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 20)

Chelsea set to sign Andrey Santos in January
Sports6 days ago

Chelsea set to sign Andrey Santos in January

APC, PDP ridicule Labour Party over the campaign list issue
News6 days ago

Victoria Chintex assassinated in Kaduna State

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories3 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 01)

News3 days ago

Buhari Appoints Hairdresser As Boss Of Financial Institution – Lawyers Demand Sack

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories3 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 02)

Cardi B
Celebrity7 days ago

Cardi B Threatens To Murder Comedian Nicole Arbour’s Mother

ANE Billboard Hots