CVE-2022-39299
published 2022-10-12CVE-2022-39299: Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML…
PriorityP356high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
3.02%
86.0th percentile
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | node-xmldom | < node-xmldom 0.8.6-1 (bookworm) | node-xmldom 0.8.6-1 (bookworm) |
| node-saml | node-saml | >= 0 < 4.0.0-beta.5 | 4.0.0-beta.5 |
| node-saml | passport-saml | >= 0 < 4.0.0-beta.3 | 4.0.0-beta.3 |
| passport-saml_project | passport-saml | < 3.2.2 | 3.2.2 |
| passport-saml_project | passport-saml | — | — |
| passport-saml_project | passport-saml | >= 0 < 3.2.2 | 3.2.2 |
| xmldom | xmldom | < 0.7.7 | 0.7.7 |
| xmldom | xmldom | <= 0.6.0 | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | >= 0 < 0.7.7 | 0.7.7 |
| xmldom | xmldom | 0 – 0.6.0 | — |
| xmldom | xmldom | >= 0.8.0 < 0.8.4 | 0.8.4 |
| xmldom | xmldom | >= 0.9.0-beta.1 < 0.9.0-beta.4 | 0.9.0-beta.4 |
| xmldom_project | xmldom | < 0.6.0 | 0.6.0 |
| xmldom_project | xmldom | — | — |
| xmldom_project | xmldom | >= 0.7.0 < 0.7.7 | 0.7.7 |
| xmldom_project | xmldom | >= 0.8.0 < 0.8.4 | 0.8.4 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa8.1HIGH
osv8.1HIGH
vendor_debian7.4HIGH
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-39353: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module
osv·2022-11-02·CVSS 8.1
CVE-2022-39353 [HIGH] CVE-2022-39353: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a
GHSA
xmldom allows multiple root nodes in a DOM
ghsa·2022-11-01·CVSS 8.1
CVE-2022-39353 [HIGH] CWE-1288 xmldom allows multiple root nodes in a DOM
xmldom allows multiple root nodes in a DOM
### Impact
xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing.
This breaks the assumption that there is only a single root node in the tree, which led to https://nvd.nist.gov/vuln/detail/CVE-2022-39299 and is a potential issue for dependents.
### Patches
Update to `@xmldom/xmldom@~0.7.7`, `@xmldom/xmldom@~0.8.4` (dist-tag `latest`) or `@xmldom/xmldom@>=0.9.0-beta.4` (dist-tag `next`).
### Workarounds
One of the following approaches might help, depending on your use case:
- Instead of searching for elements in the whole DOM, only search in the `documentElement`.
- Reject a document with a docum
OSV
xmldom allows multiple root nodes in a DOM
osv·2022-11-01·CVSS 8.1
CVE-2022-39353 [HIGH] xmldom allows multiple root nodes in a DOM
xmldom allows multiple root nodes in a DOM
### Impact
xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing.
This breaks the assumption that there is only a single root node in the tree, which led to https://nvd.nist.gov/vuln/detail/CVE-2022-39299 and is a potential issue for dependents.
### Patches
Update to `@xmldom/xmldom@~0.7.7`, `@xmldom/xmldom@~0.8.4` (dist-tag `latest`) or `@xmldom/xmldom@>=0.9.0-beta.4` (dist-tag `next`).
### Workarounds
One of the following approaches might help, depending on your use case:
- Instead of searching for elements in the whole DOM, only search in the `documentElement`.
- Reject a document with a docum
GHSA
Signature bypass via multiple root elements
ghsa·2022-10-12
CVE-2022-39299 [HIGH] CWE-347 Signature bypass via multiple root elements
Signature bypass via multiple root elements
### Impact
A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.
### Patches
Users should upgrade to passport-saml 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before v4.0.0-beta.5.
### Workarounds
Disable SAML authentication.
### References
_Are there any links users can visit to find out more?_
### For more information
If you have any questions or comments about this advisory:
* Open a discussion
OSV
Signature bypass via multiple root elements
osv·2022-10-12
CVE-2022-39299 [HIGH] Signature bypass via multiple root elements
Signature bypass via multiple root elements
### Impact
A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.
### Patches
Users should upgrade to passport-saml 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before v4.0.0-beta.5.
### Workarounds
Disable SAML authentication.
### References
_Are there any links users can visit to find out more?_
### For more information
If you have any questions or comments about this advisory:
* Open a discussion
Red Hat
xmldom: Allows multiple root elements in a DOM tree
vendor_redhat·2022-11-02·CVSS 7.4
CVE-2022-39353 [HIGH] CWE-20 xmldom: Allows multiple root elements in a DOM tree
xmldom: Allows multiple root elements in a DOM tree
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search
Debian
CVE-2022-39353: node-xmldom - xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser...
vendor_debian·2022·CVSS 7.4
CVE-2022-39353 [HIGH] CVE-2022-39353: node-xmldom - xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser...
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a
No detection rules found.
No public exploits indexed.
http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.htmlhttps://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155ehttps://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.htmlhttps://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155ehttps://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7
2022-10-12
Published