Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A
    remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful
    attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on
    the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if
    generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or
    newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you
    cannot upgrade, disabling SAML authentication may be done as a workaround. (CVE-2022-39299)

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3260 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3260-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     January 01, 2023                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : node-xmldom     Version        : 0.1.27+ds-1+deb10u2     CVE ID         : CVE-2021-21366 CVE-2022-39353     Debian Bug     : 1024736

    It was discovered that node-xmldom, a standard XML DOM (Level2 CORE)     implementation in pure javascript, processed ill-formed XML, which may result in     bugs and security holes in downstream applications.

    CVE-2021-21366

        xmldom versions 0.4.0 and older do not correctly preserve system         identifiers, FPIs or namespaces when repeatedly parsing and serializing         maliciously crafted documents.  This may lead to unexpected syntactic         changes during XML processing in some downstream applications.

    CVE-2022-39353

        Mark Gollnick discovered that xmldom parses XML that is not well-formed         because it contains multiple top level elements, and adds all root nodes to         the `childNodes` collection of the `Document`, without reporting or throwing         any error.  This breaks the assumption that there is only a single root node         in the tree, and may open security holes such as CVE-2022-39299 in         downstream applications.

    For Debian 10 buster, these problems have been fixed in version     0.1.27+ds-1+deb10u2.

    We recommend that you upgrade your node-xmldom packages.

    For the detailed security status of node-xmldom please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-xmldom

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
416865	SCA: security update for @node-saml/node-saml, @node-saml/passport-saml, node-saml, passport-saml (GHSA-m974-647v-whv7)	Tenable Cloud Security	SCA Checks	high
416865	SCA: security update for @node-saml/node-saml, @node-saml/passport-saml, node-saml, passport-saml (GHSA-m974-647v-whv7)	Tenable Self-Hosted Container Security	SCA Checks	high
169694	Debian dla-3260 : node-xmldom - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2022-39299

high

Tenable Plugins

high

high

critical