CVE-2025-29775 PoC — xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

Source

https://github.com/ethicalPap/CVE-2025-29775

Associated Vulnerability

Title: xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment (CVE-2025-29775)
Description:xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.

Readme

# SAMLStorm (CVE-2025-29775) Lab Environment

![Educational](https://img.shields.io/badge/Purpose-Educational-blue)

This is a lab environment for demonstrating the SAMLStorm vulnerability (CVE-2025-29775) that affects the xml-crypto library and SAML implementations in Node.js. (Note: This is not a true exploitation of the vulnerability, just a recreation to demonstrate how the vulnerability could work.)

## Components

- **Service Provider**: A vulnerable SAML service provider using @node-saml/node-saml
- **Identity Provider**: A simple mock SAML identity provider
- **Exploit Tool**: A web interface to demonstrate the vulnerability

## Setup

1. Make sure you have Node.js installed
2. Run the setup script:
```
python start-lab.py
```

This will:
- Generate necessary certificates
- Install dependencies
- Start all three components in separate terminals

## Usage

1. Go to the Service Provider: http://localhost:3000
2. Click "Login with SAML"
3. Enter credentials at the Identity Provider
4. Intercept the SAML response using browser dev tools or a proxy
5. Use the Exploit Tool at http://localhost:8000 to modify the response
6. Submit the modified response to demonstrate the vulnerability

## Vulnerability Details

The SAMLStorm vulnerability (CVE-2025-29775) affects the xml-crypto library, which is used by many SAML implementations in the Node.js ecosystem. The vulnerability allows attackers to bypass signature verification by inserting comments within the DigestValue element of a SAML response.

For more information:
- https://nvd.nist.gov/vuln/detail/CVE-2025-29775
- https://workos.com/blog/samlstorm

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →