samlify Signature Wrapping Vulnerability Allowing User Forgery

A Signature Wrapping vulnerability has been identified in the samlify library for Node.js, specifically in versions prior to 2.10.0. This vulnerability allows an attacker to forge a SAML Response and authenticate as any user. To exploit this issue, the attacker must possess a signed XML document from the identity provider.

Impact

Exploitation of this vulnerability could lead to unauthorized user authentication by forging SAML Responses.

Reproduction

The vulnerability can be reproduced by using a version of samlify prior to 2.10.0. An attacker must obtain a signed XML document from the identity provider and then manipulate it to include a forged SAML Response that can be accepted by the service provider.

Remediation

Users can upgrade to samlify version 2.10.0 or later to address this vulnerability.