=====================================================================

                                CERT-Renater

                     Note d'Information No. 2023/VULN252

_____________________________________________________________________

DATE                : 22/08/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running saml.js versions prior to 4.0.5.

=====================================================================
https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccw
_____________________________________________________________________

validatePostRequestAsync does not include checkTimestampsValidityError
Moderate
cjbarth published GHSA-vx8m-6fhw-pccw Aug 19, 2023

Package
saml.js

Affected versions
<4.0.4

Patched versions
4.0.5

Description

Summary

The lack of checking of current timestamp allows a LogoutRequest XML
to be reused multiple times even when the current time is past the
NotOnOrAfter.


Details

It was noticed that in the validatePostRequestAsync() flow in
saml.js, the current timestamp is never checked. This could present
a vulnerability where a user who has an XML LogoutRequest could
validated it if the IssueInstance and the NotOnOrAfter are valid
along with valid credentials (signature, certificate etc.).


PoC

I was able to validate a sample valid LogoutRequest XML multiple
times through postman by sending it to my endpoint regardless if
the current present time was past the NotOnOrAfter time. After
some further testing, it seems that only the IssueInstance is
checked against NotOnOrAfter. Not sure if this was the intended
behaviour but I believe having a never expiring valid
LogoutRequest could be dangerous.


Impact

This could impact the user where they would be logged out from
an expired LogoutRequest. In bigger contexts, if LogoutRequests
are sent out in mass to different SPs, this could impact many
users on a large scale.


Severity
Moderate

5.3/ 10

CVSS base metrics

Attack vector
Network

Attack complexity
Low

Privileges required
None

User interaction
None

Scope
Unchanged

Confidentiality
None

Integrity
None

Availability
Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE ID
CVE-2023-40178

Weaknesses
No CWEs


Credits

     @jindazhao01 jindazhao01

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================