CVE-2023-40178 - CVE House

Back to Database

Status published Medium CVE-2023-40178

@node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError

5.3 CVSS

Vulnerability Description

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an expired LogoutRequest. In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large scale. This issue was patched in version 4.0.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-40178

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from node-saml

View All →

Node-SAML Contains SAML Signature Verification Vulnerability

Node-SAML SAML Authentication Bypass

xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

XML signature verification bypass due improper verification of signature / signature spoofing

Affected Vendor

node-saml

View all reports →

Affected Software

node-saml

Vulnerable Versions:

< 4.0.5

Timeline

Official Publish: August 23rd, 2023

Last Modified: October 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1553 Subvert Trust Controls

Defense Evasion

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1565 Data Manipulation