github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the victim’s browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: SP registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or publicly accessible to ease the IdP interoperability. This issue is fixed in version 0.4.14. Users unable to upgrade may perform external validation of URLs provided in SAML metadata, or restrict the ability for end-users to upload arbitrary metadata.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not     validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows     attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint     definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a     SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the     victim's browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: SP     registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or     publicly accessible to ease the IdP interoperability. This issue is fixed in version 0.4.14. Users unable     to upgrade may perform external validation of URLs provided in SAML metadata, or restrict the ability for     end-users to upload arbitrary metadata. (CVE-2023-45683)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not
    validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows
    attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint
    definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a
    SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the
    victim’s browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: SP
    registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or
    publicly accessible to ease the IdP interoperability. This issue is fixed in version 0.4.14. Users unable
    to upgrade may perform external validation of URLs provided in SAML metadata, or restrict the ability for
    end-users to upload arbitrary metadata. (CVE-2023-45683)

ID	Name	Product	Family	Severity
260954	Linux Distros Unpatched Vulnerability : CVE-2023-45683	Nessus	Misc.	medium
408727	SCA: security update for github.com/crewjam/saml (GHSA-267v-3v32-g6q5)	Tenable Cloud Security	SCA Checks	medium
408727	SCA: security update for github.com/crewjam/saml (GHSA-267v-3v32-g6q5)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2023-45683

medium

Tenable Plugins

medium

medium

medium