CVE-2017-11430: Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal
OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Other sources
OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11430?
CVE-2017-11430 is classified as a high-severity vulnerability due to its potential to allow attackers to manipulate SAML data without invalidating the signature.
How do I fix CVE-2017-11430?
To fix CVE-2017-11430, upgrade the omniauth-saml package to version 1.10.0 or later.
What software is affected by CVE-2017-11430?
CVE-2017-11430 affects versions of omniauth-saml up to and including 1.9.0.
What type of vulnerability is CVE-2017-11430?
CVE-2017-11430 is a SAML-related vulnerability that involves issues with XML DOM traversal and canonicalization.
Can CVE-2017-11430 be exploited remotely?
Yes, CVE-2017-11430 can potentially be exploited remotely by attackers to bypass authentication mechanisms.