CVE-2022-39299

Deeper analysis

Passport-SAML is a SAML 2.0 authentication provider for the Passport Node.js library, and the same flaw also affects the node-saml library in its early beta releases. CVE-2022-39299 is a signature-verification bypass (CWE-347) that permits an attacker to substitute an arbitrary IDP-signed XML element for a legitimate authentication response, thereby evading the cryptographic checks that should enforce identity.

An attacker who possesses or can obtain a signed XML element from the configured identity provider can submit it to the service provider and be granted an authenticated session. When the IDP permits an unauthenticated user to trigger generation of a signed message, the attack can succeed without any valid credentials; otherwise the attacker still needs network access to the SAML endpoint but no user account on the target application. The CVSS 7.4 rating reflects the high attack complexity arising from the need for a signed element.

Public advisories and the associated GitHub security notice recommend immediate upgrade to passport-saml 3.2.2 or later and node-saml 4.0.0-beta.5 or later; the fixes are contained in the commits that tighten root-element signature validation. Where patching is not feasible, the recommended workaround is to disable SAML authentication entirely.

EPSS for the vulnerability rose from a low baseline to a peak of 0.1302 before receding to the current 0.0465, indicating a measurable increase in exploitation interest after disclosure. Public references include exploit code posted to Packet Storm, although no widespread in-the-wild campaigns are documented in the supplied sources.