Vulnerability Instance

Link injection in SimpleSAMLphp
### Background
Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out.

### Description
The following scripts were not checking the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on:

- `www/logout.php`
- `modules/core/www/no_cookie.php`

The issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack of security checks involving the `link_href` and `retryURL` HTTP parameters, respectively. The issue was resolved by including a verification of the URLs received in the request against a white list of websites specified in the `trusted.url.domains` configuration option.

### Affected versions
All SimpleSAMLphp versions prior to 1.14.4.

### Impact
A remote attacker could craft a link pointing to a trusted website running SimpleSAMLphp, including a parameter pointing to a malicious website, and try to fool the victim into visiting that website by clicking on a link in the page presented by SimpleSAMLphp.

### Resolution
Upgrade to the latest version.

### Credit
This security issue was discovered and reported by John Page (hyp3rlinx).