CVE-2017-11429
HIGHCVE-2017-11429 is a high-severity (CVSS 7.7) Improper Authentication vulnerability in saml2-js. 1 public exploit reference exists, so weaponization risk is real. O3 Security confirms whether CVE-2017-11429 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js
Real-World Exposure
saml2-js📦saml2-jsReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.
Description
Versions of saml2-js prior to 1.12.4 or 2.0.2 are vulnerable to authentication bypass.
The saml2-js library may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Security Assertion Markup Language (SAML) is an XML-based markup language for security assertions regarding authentication and permissions, most commonly used for single sign-on (SSO) services.
Some XML DOM traversal and canonicalization APIs may be inconsistent in handling of comments within XML nodes. Incorrect use of these APIs by some SAML libraries results in incorrect parsing of the inner text of XML nodes such that any inner text after the comment is lost prior to cryptographically signing the SAML message. Text after the comment therefore has no impact on the signature on the SAML message.
A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider
Recommendation
If you use 1.x upgrade to version 1.12.4 or greater If you use 2.x upgrade to version 2.02 or greater
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | saml2-js | all versions | 1.12.4 |
| 📦npm | saml2-js | ≥ 2.0.0&&< 2.0.2 | 2.0.2 |
Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for saml2-js. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update saml2-js to 1.12.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2017-11429 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2017-11429 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2017-11429. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2017-11429 in your dependencies?
O3 detects CVE-2017-11429 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.