Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. This issue is fixed in version 5.1.0.
Node-SAML verifies the signature on a specific fragment of the SAML response document, however it loads the assertion from an unsigned part of the same document for further processing (CWE-347: lack of cryptographic signature verification for the correct fragment). The discrepancy between the verified fragment and the actually processed one allows an attacker to inject modified data into the assertion (CWE-87). For example, it is possible to remove any character from the username contained in the assertion, which could lead to impersonation of another user.
An attacker can modify authentication data contained in the SAML assertion — including user identity — without violating the validity of the cryptographic signature, which may lead to unauthorized access to protected resources or privilege escalation.
Node-SAML should be updated to version 5.1.0, where the bug has been fixed. Patch available in the project's GitHub repository (tag v5.1.0).
Node-SAML in versions 5.0.1 and earlier
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X