github - ghsa-94hm-8q65-rmxm

ghsa-94hm-8q65-rmxm

Vulnerability from github

Published

2019-07-05 21:11

Modified

2023-08-29 14:57

Severity ?

7.7 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal

Details

OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Show details on source website

JSON

To clipboard

{
   affected: [
      {
         package: {
            ecosystem: "RubyGems",
            name: "omniauth-saml",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     fixed: "1.10.0",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2017-11430",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-287",
      ],
      github_reviewed: true,
      github_reviewed_at: "2020-06-16T21:27:27Z",
      nvd_published_at: null,
      severity: "HIGH",
   },
   details: "OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.",
   id: "GHSA-94hm-8q65-rmxm",
   modified: "2023-08-29T14:57:21Z",
   published: "2019-07-05T21:11:43Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2017-11430",
      },
      {
         type: "WEB",
         url: "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations",
      },
      {
         type: "PACKAGE",
         url: "https://github.com/omniauth/omniauth-saml",
      },
      {
         type: "WEB",
         url: "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/CVE-2017-11430.yml",
      },
      {
         type: "WEB",
         url: "https://www.kb.cert.org/vuls/id/475445",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
         type: "CVSS_V3",
      },
   ],
   summary: "OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal",
}

cve-2017-11430

Vulnerability from cvelistv5

Published

2019-04-17 14:00

Modified

2024-08-05 18:12

Severity ?

7.7 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

References

▼	URL	Tags
	https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/475445	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	OmniAuth	OmnitAuth-SAML	Version: unspecified < 1.9.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T18:12:39.543Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.kb.cert.org/vuls/id/475445",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "OmnitAuth-SAML",
               vendor: "OmniAuth",
               versions: [
                  {
                     lessThan: "1.9.0",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Kelby Ludwig of Duo Security",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.7,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-287",
                     description: "CWE-287: Improper Authentication",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-04-17T14:00:30",
            orgId: "7cd4c57f-0a88-4dda-be53-70336b413766",
            shortName: "duo",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.kb.cert.org/vuls/id/475445",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         title: " Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@duo.com",
               ID: "CVE-2017-11430",
               STATE: "PUBLIC",
               TITLE: " Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "OmnitAuth-SAML",
                                 version: {
                                    version_data: [
                                       {
                                          affected: "<",
                                          version_affected: "<",
                                          version_value: "1.9.0",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "OmniAuth",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "Kelby Ludwig of Duo Security",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.7,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.0",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-287: Improper Authentication",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations",
                     refsource: "MISC",
                     url: "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations",
                  },
                  {
                     name: "https://www.kb.cert.org/vuls/id/475445",
                     refsource: "MISC",
                     url: "https://www.kb.cert.org/vuls/id/475445",
                  },
               ],
            },
            source: {
               discovery: "INTERNAL",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "7cd4c57f-0a88-4dda-be53-70336b413766",
      assignerShortName: "duo",
      cveId: "CVE-2017-11430",
      datePublished: "2019-04-17T14:00:30",
      dateReserved: "2017-07-18T00:00:00",
      dateUpdated: "2024-08-05T18:12:39.543Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

gsd-2017-11430

Vulnerability from gsd

Modified

2018-02-27 00:00

Details

Aliases

CVE-2017-11430

JSON

To clipboard

{
   GSD: {
      alias: "CVE-2017-11430",
      description: "OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.",
      id: "GSD-2017-11430",
   },
   gsd: {
      metadata: {
         exploitCode: "unknown",
         remediation: "unknown",
         reportConfidence: "confirmed",
         type: "vulnerability",
      },
      osvSchema: {
         affected: [
            {
               package: {
                  ecosystem: "RubyGems",
                  name: "omniauth-saml",
                  purl: "pkg:gem/omniauth-saml",
               },
            },
         ],
         aliases: [
            "CVE-2017-11430",
            "GHSA-94hm-8q65-rmxm",
         ],
         details: "OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the\nresults of XML DOM traversal and canonicalization APIs in such a way that an attacker\nmay be able to manipulate the SAML data without invalidating the cryptographic signature,\nallowing the attack to potentially bypass authentication to SAML service providers.\n",
         id: "GSD-2017-11430",
         modified: "2018-02-27T00:00:00.000Z",
         published: "2018-02-27T00:00:00.000Z",
         references: [
            {
               type: "WEB",
               url: "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations",
            },
         ],
         schema_version: "1.4.0",
         severity: [
            {
               score: 7.5,
               type: "CVSS_V2",
            },
            {
               score: 9.8,
               type: "CVSS_V3",
            },
         ],
         summary: "omniauth-saml authentication bypass via incorrect XML canonicalization and DOM traversal",
      },
   },
   namespaces: {
      "cve.org": {
         CVE_data_meta: {
            ASSIGNER: "security@duo.com",
            ID: "CVE-2017-11430",
            STATE: "PUBLIC",
            TITLE: " Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal",
         },
         affects: {
            vendor: {
               vendor_data: [
                  {
                     product: {
                        product_data: [
                           {
                              product_name: "OmnitAuth-SAML",
                              version: {
                                 version_data: [
                                    {
                                       affected: "<",
                                       version_value: "1.9.0",
                                    },
                                 ],
                              },
                           },
                        ],
                     },
                     vendor_name: "OmniAuth",
                  },
               ],
            },
         },
         credit: [
            {
               lang: "eng",
               value: "Kelby Ludwig of Duo Security",
            },
         ],
         data_format: "MITRE",
         data_type: "CVE",
         data_version: "4.0",
         description: {
            description_data: [
               {
                  lang: "eng",
                  value: "OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.",
               },
            ],
         },
         impact: {
            cvss: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.7,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
               version: "3.0",
            },
         },
         problemtype: {
            problemtype_data: [
               {
                  description: [
                     {
                        lang: "eng",
                        value: "CWE-287: Improper Authentication",
                     },
                  ],
               },
            ],
         },
         references: {
            reference_data: [
               {
                  name: "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations",
                  refsource: "MISC",
                  url: "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations",
               },
               {
                  name: "https://www.kb.cert.org/vuls/id/475445",
                  refsource: "MISC",
                  url: "https://www.kb.cert.org/vuls/id/475445",
               },
            ],
         },
         source: {
            discovery: "INTERNAL",
         },
      },
      "github.com/rubysec/ruby-advisory-db": {
         cve: "2017-11430",
         cvss_v2: 7.5,
         cvss_v3: 9.8,
         date: "2018-02-27",
         description: "OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the\nresults of XML DOM traversal and canonicalization APIs in such a way that an attacker\nmay be able to manipulate the SAML data without invalidating the cryptographic signature,\nallowing the attack to potentially bypass authentication to SAML service providers.\n",
         gem: "omniauth-saml",
         ghsa: "94hm-8q65-rmxm",
         patched_versions: [
            ">= 1.10.0",
         ],
         title: "omniauth-saml authentication bypass via incorrect XML canonicalization and DOM traversal",
         url: "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations",
      },
      "gitlab.com": {
         advisories: [
            {
               affected_range: "<=1.9.0",
               affected_versions: "All versions up to 1.9.0",
               cvss_v2: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               cwe_ids: [
                  "CWE-1035",
                  "CWE-287",
                  "CWE-937",
               ],
               date: "2019-10-09",
               description: "OmniAuth OmnitAuth-SAML may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing an attacker to potentially bypass authentication to SAML service providers.",
               fixed_versions: [
                  "1.10.0",
               ],
               identifier: "CVE-2017-11430",
               identifiers: [
                  "CVE-2017-11430",
               ],
               not_impacted: "All versions after 1.9.0",
               package_slug: "gem/omniauth-saml",
               pubdate: "2019-04-17",
               solution: "Upgrade to version 1.10.0 or above.",
               title: "Improper Authentication",
               urls: [
                  "https://nvd.nist.gov/vuln/detail/CVE-2017-11430",
               ],
               uuid: "b8166d51-e3f4-4bc6-9910-8560fd588fab",
            },
         ],
      },
      "nvd.nist.gov": {
         configurations: {
            CVE_data_version: "4.0",
            nodes: [
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:omnitauth-saml_project:omnitauth-saml:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndIncluding: "1.9.0",
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
         cve: {
            CVE_data_meta: {
               ASSIGNER: "security@duo.com",
               ID: "CVE-2017-11430",
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "en",
                     value: "OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "en",
                           value: "CWE-287",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.kb.cert.org/vuls/id/475445",
                     refsource: "MISC",
                     tags: [
                        "Third Party Advisory",
                        "US Government Resource",
                     ],
                     url: "https://www.kb.cert.org/vuls/id/475445",
                  },
                  {
                     name: "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations",
                     refsource: "MISC",
                     tags: [
                        "Exploit",
                        "Technical Description",
                        "Third Party Advisory",
                     ],
                     url: "https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations",
                  },
               ],
            },
         },
         impact: {
            baseMetricV2: {
               acInsufInfo: false,
               cvssV2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               exploitabilityScore: 10,
               impactScore: 6.4,
               obtainAllPrivilege: false,
               obtainOtherPrivilege: false,
               obtainUserPrivilege: false,
               severity: "HIGH",
               userInteractionRequired: false,
            },
            baseMetricV3: {
               cvssV3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               exploitabilityScore: 3.9,
               impactScore: 5.9,
            },
         },
         lastModifiedDate: "2019-10-09T23:22Z",
         publishedDate: "2019-04-17T14:29Z",
      },
   },
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-94hm-8q65-rmxm

Vulnerability from github

cve-2017-11430

Vulnerability from cvelistv5

gsd-2017-11430

Vulnerability from gsd

Tags

Sightings

Nomenclature