When loading rules for SID 2060960, 2060961, the message 'fast_pattern is ineffective with base64_data' occurs

Rule Signatures
,
1

When loading rules for SIDs 2060960, 2060961, it throws the message ‘fast_pattern is ineffective with base64_data’.

alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET WEB_SPECIFIC_APPS xml-crypto / Node.js SAML Authentication Bypass Forged DigestValue Comment (CVE-2025-29775)”; flow:established,to_server; http.method; content:“POST”; http.request_body; content:“SAMLResponse|3d|”; base64_decode:offset 0, relative; base64_data; content:“|3c|saml2p|3a|Response”; content:“|3c|DigestValue|3e 3c 21 2d 2d|”; fast_pattern; pcre:“/[1]+\x3d*\x2d\x2d\x3e[A-Za-z0-9\x2b\x2f]+\x3d*\x3c\x2fds\x3aDigestValue\x3e/R”; reference:url,SAMLStorm: Critical Authentication Bypass in xml-crypto and Node.js libraries — WorkOS; reference:cve,2025-29775; classtype:web-application-attack; sid:2060960; rev:1; metadata:affected_product Node_js, attack_target Server, tls_state TLSDecrypt, created_at 2025_03_19, cve CVE_2025_29775, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, updated_at 2025_03_19, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

alert http $EXTERNAL_NET any → $HOME_NET any (msg:“ET WEB_SPECIFIC_APPS xml-crypto SAML Authentication Bypass Multiple SignedInfo References (CVE-2025-29774)”; flow:established,to_server; http.method; content:“POST”; http.request_body; content:“SAMLResponse|3d|”; base64_decode:offset 0, relative; base64_data; content:“|3c|saml2p|3a|Response”; content:“|3c|SignedInfo|3e|”; fast_pattern; content:“|3c|SignedInfo|3e|”; distance:0; reference:url,XML Signature Verification Bypass via Multiple SignedInfo References · Advisory · node-saml/xml-crypto · GitHub; reference:cve,2025-29774; classtype:web-application-attack; sid:2060961; rev:1; metadata:attack_target Server, tls_state TLSDecrypt, created_at 2025_03_19, cve CVE_2025_29774, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, updated_at 2025_03_19, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

  1. A-Za-z0-9\x2b\x2f ↩︎

1 Like
2

Thanks for reporting this. The error you’re getting is warning that fast_pattern can’t be used in the base64_data; sticky buffer for technical reasons. These rules have since been modified, and the newly modified rules will be available in today’s rule release.

Thanks,

Tony

1 Like