socialtables / saml-protocol Goto Github PK
View Code? Open in Web Editor NEWA framework-agnostic SAML protocol implementation for service and identity providers
A framework-agnostic SAML protocol implementation for service and identity providers
Is there a way to send in the SAML Request a RelayState param?
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/xmldom/-/xmldom-0.5.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xml-crypto/node_modules/xmldom/package.json
Dependency Hierarchy:
Found in HEAD commit: 73b34e5ab4dd4df4269ecbd89db52f145f10d284
Found in base branch: master
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Publish Date: 2021-07-27
URL: CVE-2021-32796
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-5fg8-2547-mr8q
Release Date: 2021-07-27
Fix Resolution: xmldom - 0.7.0
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.7.0.tgz
Dependency Hierarchy:
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.7.5.tgz
Dependency Hierarchy:
Found in base branch: main
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
Publish Date: 2022-10-11
URL: CVE-2022-37616
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37616
Release Date: 2022-10-11
Fix Resolution: @xmldom/xmldom - 0.8.3
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.6.38.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xml-encryption/node_modules/node-forge/package.json
Dependency Hierarchy:
Found in HEAD commit: 73b34e5ab4dd4df4269ecbd89db52f145f10d284
Found in base branch: master
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo
ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24772
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (xml-encryption): 2.0.0
⛑️ Automatic Remediation is available for this issue
Parse, validate, manipulate, and display dates
Library home page: https://registry.npmjs.org/moment/-/moment-2.29.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/moment/package.json
Dependency Hierarchy:
Found in HEAD commit: 73b34e5ab4dd4df4269ecbd89db52f145f10d284
Found in base branch: master
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.
Publish Date: 2022-07-06
URL: CVE-2022-31129
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-wc69-rhjr-hc9g
Release Date: 2022-07-06
Fix Resolution: moment - 2.29.4
⛑️ Automatic Remediation is available for this issue
Is there support for SAML Artifact Resolution?
Embedded JavaScript templates
Library home page: https://registry.npmjs.org/ejs/-/ejs-0.8.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ejs/package.json
Dependency Hierarchy:
Found in HEAD commit: 73b34e5ab4dd4df4269ecbd89db52f145f10d284
Found in base branch: master
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
Publish Date: 2017-11-17
URL: CVE-2017-1000228
Base Score Metrics:
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000228
Release Date: 2017-11-17
Fix Resolution (ejs): 2.5.3
Direct dependency fix Resolution (xml-encryption): 0.11.0
⛑️ Automatic Remediation is available for this issue
Can you please provide more explanatory setup with some example appliation?
I'm trying to use to integrate saml-protocol with my testing application for federated logging (https://github.com/lager1/fed_test), but it's very unclear for me how to use it within my app.
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.6.38.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xml-encryption/node_modules/node-forge/package.json
Dependency Hierarchy:
Found in HEAD commit: 73b34e5ab4dd4df4269ecbd89db52f145f10d284
Found in base branch: master
forge is vulnerable to URL Redirection to Untrusted Site
Publish Date: 2022-01-06
URL: CVE-2022-0122
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-gf8q-jrpm-jvxq
Release Date: 2022-01-06
Fix Resolution (node-forge): 1.0.0
Direct dependency fix Resolution (xml-encryption): 2.0.0
⛑️ Automatic Remediation is available for this issue
An XML builder for node.js
Library home page: https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-8.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xmlbuilder/package.json
Dependency Hierarchy:
Found in HEAD commit: 73b34e5ab4dd4df4269ecbd89db52f145f10d284
Found in base branch: master
The package xmlbuilder-js before 9.0.5 is vulnerable to denial of service due to a regular expression issue.
Publish Date: 2018-02-08
URL: WS-2018-0625
Base Score Metrics:
Type: Upgrade version
Origin: oozcitak/xmlbuilder-js@bbf929a
Release Date: 2018-02-08
Fix Resolution: 9.0.5
⛑️ Automatic Remediation is available for this issue
A W3C Standard XML DOM(Level2 CORE) implementation and parser(DOMParser/XMLSerializer).
Library home page: https://registry.npmjs.org/xmldom/-/xmldom-0.1.31.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xml-encryption/node_modules/xmldom/package.json
Dependency Hierarchy:
Found in HEAD commit: 73b34e5ab4dd4df4269ecbd89db52f145f10d284
Found in base branch: master
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Publish Date: 2021-03-12
URL: CVE-2021-21366
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-h6q6-9hqw-rwfv
Release Date: 2021-03-12
Fix Resolution (xmldom): 0.5.0
Direct dependency fix Resolution (xml-encryption): 1.2.3
⛑️ Automatic Remediation is available for this issue
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.7.5.tgz
Dependency Hierarchy:
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.7.0.tgz
Dependency Hierarchy:
Found in base branch: main
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser
and XMLSerializer
module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes
collection of the Document
, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the documentElement
or reject a document with a document that has more then 1 childNode
.
Publish Date: 2022-11-02
URL: CVE-2022-39353
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-crh6-fp67-6883
Release Date: 2022-11-02
Fix Resolution: @xmldom/xmldom - 0.7.7,0.8.4
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.6.38.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xml-encryption/node_modules/node-forge/package.json
Dependency Hierarchy:
Found in HEAD commit: 73b34e5ab4dd4df4269ecbd89db52f145f10d284
Found in base branch: master
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24771
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (xml-encryption): 2.0.0
⛑️ Automatic Remediation is available for this issue
The produced metadata is invalid according to the XSD schema when using logout endpoints.
As shown in the schema: https://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd
A logout service is a non-indexed endpoint, thus without index attribute. Furthermore, it should appear right before NameIDService (I know, xml sucks)
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.6.38.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xml-encryption/node_modules/node-forge/package.json
Dependency Hierarchy:
Found in HEAD commit: 73b34e5ab4dd4df4269ecbd89db52f145f10d284
Found in base branch: master
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo
for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24773
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (xml-encryption): 2.0.0
⛑️ Automatic Remediation is available for this issue
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.6.38.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xml-encryption/node_modules/node-forge/package.json
Dependency Hierarchy:
Found in HEAD commit: 73b34e5ab4dd4df4269ecbd89db52f145f10d284
Found in base branch: master
The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.
Publish Date: 2022-01-08
URL: WS-2022-0008
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-5rrq-pxf6-6jx5
Release Date: 2022-01-08
Fix Resolution (node-forge): 1.0.0
Direct dependency fix Resolution (xml-encryption): 2.0.0
⛑️ Automatic Remediation is available for this issue
The response-handling.js function 'processResponse' assumes a namespace of 'saml' will be used, rather than determining the namespace in use. See this line:
const issuer = select("//saml:Issuer/text()", doc)[0];
Here is a (redacted) example of an assertion document from JumpCloud that uses 'saml2' as the namespace instead, resulting in error Unable to identify issuer
from the library:
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" Destination="[redacted]" ID="WAMZQUBSJDBBO56N4GDAOIQ7TGES1LZF26DQKGQH" InResponseTo="_5a0b2e41c065123098fd8dfe9e976e599cbd1dd707" IssueInstant="2017-09-26T14:23:42.861Z" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">[redacted]</saml2:Issuer>
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</saml2p:Status>
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="CUT79RCQADD3XJBV81B79HT6YO697938EAL31PDV" IssueInstant="2017-09-26T14:23:42.861Z" Version="2.0">
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">[redacted]</saml2:Issuer>
...
</saml2:Assertion>
</saml2p:Response>
`
Higher-order functions and common patterns for asynchronous code
Library home page: https://registry.npmjs.org/async/-/async-0.2.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/async/package.json
Dependency Hierarchy:
Found in HEAD commit: 73b34e5ab4dd4df4269ecbd89db52f145f10d284
Found in base branch: master
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
Publish Date: 2022-04-06
URL: CVE-2021-43138
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138
Release Date: 2022-04-06
Fix Resolution (async): 2.6.4
Direct dependency fix Resolution (xml-encryption): 0.12.0
⛑️ Automatic Remediation is available for this issue
Hello,
Seems that in the lib/response-construction.js
file,
in line 231, It should be saml:AuthnContext
instead of saml:AuthnContex
, it's missing the tailing t
character.
Validating on an online platform wouldn't pass without correcting it...
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.6.38.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xml-encryption/node_modules/node-forge/package.json
Dependency Hierarchy:
Found in HEAD commit: 73b34e5ab4dd4df4269ecbd89db52f145f10d284
Found in base branch: master
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
Publish Date: 2020-09-01
URL: CVE-2020-7720
Base Score Metrics:
Type: Upgrade version
Origin: https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md
Release Date: 2020-09-01
Fix Resolution (node-forge): 0.10.0
Direct dependency fix Resolution (xml-encryption): 1.2.1
⛑️ Automatic Remediation is available for this issue
In trying to use saml-protocol, I was getting an error 'this.model.verifyRequestID is not a function'.
I added another function to my model that took a requestID, and idpConfig, and returned a promise.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.