GHSA-j2jp-wvqg-wc2g CVE-2022-41912 GO-2022-1129
crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication
- Severity
- 9.1 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 2.33%
- Chance of exploitation in the next 30 days. Higher than 83.50% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-287 Improper Authentication
- Fix
0.4.9- Upgrade github.com/crewjam/saml to this version or later
Description
Impact
The crewjam/saml go library is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements.
Patches
This issue has been corrected in version 0.4.9.
Credit
This issue was reported by Felix Wilhelm from Google Project Zero.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/crewjam/saml | < 0.4.9 |
0.4.9 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/crewjam/saml Go → 0.4.9
- go
go get github.com/crewjam/saml@v0.4.9 && go mod tidy
Severity breakdown
CVSS 3.1 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
References
Advisories
Packages
Other links
- github.com/crewjam/saml/security/advisories/GHSA-j2jp-wvqg-wc2g
- github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p
- github.com/crewjam/saml/commit/aee3fb1edeeaf1088fcb458727e0fd863d277f8b
- github.com/crewjam/saml/releases/tag/v0.4.9
- pkg.go.dev/vuln/GO-2022-1129
- packetstormsecurity.com/files/170356/crewjam-saml-Signature-Bypass.html
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-267v-3v32-g6q5 Cross-site Scripting via missing Binding syntax validation | Medium | Also affects github.com/crewjam/saml |
| GHSA-5mqj-xc49-246p crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb | High | Also affects github.com/crewjam/saml |
| GHSA-4hq8-gmxx-h6w9 XML Processing error in github.com/crewjam/saml | Critical | Also affects github.com/crewjam/saml |
| GHSA-f9x3-7vq9-cph6 Laravel TokenGuard authentication bypass through non-string API credentials | Critical | Same weakness, CWE-287 |
| GHSA-r4xp-prcw-77qf better-auth: OAuth Proxy lets an attacker sign in as another user | Critical | Same weakness, CWE-287 |
| GHSA-965c-763c-88jm better-auth: OAuth state can be used as a Magic Link to sign in as another user | Critical | Same weakness, CWE-287 |
| GO-2026-6773 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF) | High | Same weakness, CWE-287 |
| GO-2026-6786 Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover | High | Same weakness, CWE-287 |
Credits: Felix Wilhelm from Google Project Zero
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor