The express-saml from bozzltron

Generates invalid dates

Note the "+2": date.getUTCHours()+2

This means your timestamps are out of whack and invalid for two hour each day.

This library has all possible SAML related vulnerabilities

Just in case someone is using or considers using this library (or to copy paste code from this library)...

This library has every possible SAML related vulnerability that one could list starting from the fact that it does not validate authentication response signature which means that SW that uses this library / copy paste from this library is open for everyone in the internet. Everyone can scratch authentication response with any NameID and post it to SW that uses this library in order to have authenticated session (impersonate anyone).

I.e. code linked to the end of this issue does not have any security measurements listed e.g. in these documents:

Security and Privacy Considerations for the OASIS Security Assertion Markup Language (SAML) V2.0
OASIS Standard, 15 March 2005
https://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf
https://cheatsheetseries.owasp.org/cheatsheets/SAML_Security_Cheat_Sheet.html
https://sec.okta.com/articles/2020/05/common-pitfalls-custom-saml-implementations

And that code does not follow any processing rules (which are related to security) listed in these specifications (SAML core and SAML Web SSO profile related parts):

Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0
OASIS Standard, 15 March 2005
https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
Profiles for the OASIS Security Assertion Markup Language (SAML) V2.0
OASIS Standard, 15 March 2005
https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf

express-saml/saml.js

Lines 5 to 44 in 9c04343

    
           // Receive the SAML Response here 
        
           app.post('/saml/consume', function(req, res){ 
        
             var libxmljs = require("libxmljs"); 
        
             // Get SAML response 
        
             var samlResponse = req.body.SAMLResponse; 
        
             // Decode response 
        
             var xml = new Buffer(samlResponse, 'base64').toString('ascii'); 
        
             // Parse ID 
        
             var xmlDoc = libxmljs.parseXmlString(xml); 
        
             var idNode = xmlDoc.get('/samlp:Response/saml:Assertion/saml:Subject/saml:NameID', { 
        
               'samlp':'urn:oasis:names:tc:SAML:2.0:protocol', 
        
               'saml' : 'urn:oasis:names:tc:SAML:2.0:assertion' 
        
             }); 
        
             var email = idNode.text(); 
        
             // User lookup 
        
             app.settings.models.User.findOne({email:email}, function(err, user){ 
        
               if (user) { 
        
                 // Grant session 
        
                 req.session.currentUser = user; 
        
                 req.flash('info', 'You are logged in as ' + email); 
        
                 res.redirect('/'); 
        
                 return; 
        
               } else { 
        
                 // Redirect 
        
                 req.flash('error', 'Your account did not match any of our records.'); 
        
                 res.redirect('/login'); 
        
                 return; 
        
               } 
        
             });     
        
           });

Missing license information

Great work on adding SAML support to Node.js! I'm looking to adapt your approach to make a SAML strategy for the Passport authentication library.

I noticed there is no license information in your repository. Is the plan to have this under MIT like most Node.js code, or?

bozzltron / express-saml Goto Github PK

express-saml's People

Stargazers

Watchers

Forkers

express-saml's Issues

Generates invalid dates

This library has all possible SAML related vulnerabilities

Missing license information

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	// Receive the SAML Response here
	app.post('/saml/consume', function(req, res){

	var libxmljs = require("libxmljs");

	// Get SAML response
	var samlResponse = req.body.SAMLResponse;

	// Decode response
	var xml = new Buffer(samlResponse, 'base64').toString('ascii');

	// Parse ID
	var xmlDoc = libxmljs.parseXmlString(xml);
	var idNode = xmlDoc.get('/samlp:Response/saml:Assertion/saml:Subject/saml:NameID', {
	'samlp':'urn:oasis:names:tc:SAML:2.0:protocol',
	'saml' : 'urn:oasis:names:tc:SAML:2.0:assertion'
	});

	var email = idNode.text();

	// User lookup
	app.settings.models.User.findOne({email:email}, function(err, user){

	if (user) {

	// Grant session
	req.session.currentUser = user;
	req.flash('info', 'You are logged in as ' + email);
	res.redirect('/');
	return;
	} else {

	// Redirect
	req.flash('error', 'Your account did not match any of our records.');
	res.redirect('/login');
	return;
	}
	});

	});