Search for packages
| purl | pkg:composer/simplesamlphp/simplesamlphp@1.14.17 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-4gux-4jrc-w7ce
Aliases: CVE-2018-6520 GHSA-2qfc-48v5-4w5h |
URL Redirection to Untrusted Site (Open Redirect) `SimpleSAMLphp` allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL. |
Affected by 2 other vulnerabilities. |
|
VCID-6fwf-1xps-t7g5
Aliases: CVE-2020-5301 GHSA-24m3-w8g9-jwpq |
Information Exposure SimpleSAMLphp contain an information disclosure vulnerability. The module controller in `SimpleSAML\Module` that processes requests for pages hosted by modules, has code to identify paths ending with `.php` and process those as PHP code. If no other suitable way of handling the given path exists, it presents the file to the browser. The check to identify paths ending with `.php` does not account for uppercase letters. If someone requests a path ending with e.g. `.PHP` and the server is serving the code from a case-insensitive file system, such as on Windows, the processing of the PHP code does not occur, and the source code is instead presented to the browser. An attacker may use this issue to gain access to the source code in third-party modules that is meant to be private, or even sensitive. However, the attack surface is considered small, as the attack will only work when SimpleSAMLphp serves such content from a file system that is not case-sensitive, such as on Windows. |
Affected by 0 other vulnerabilities. |
|
VCID-d1cm-xhdp-8qhv
Aliases: GMS-2019-149 |
Cross-site Scripting Reflected Cross-Site-Scripting in simplesamlphp. |
Affected by 3 other vulnerabilities. |
|
VCID-ywuy-my3f-x7cd
Aliases: CVE-2018-6521 GHSA-qv5p-6wrc-79wg |
Security Misconfigurations The sqlauth module in `SimpleSAMLphp` relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-cmqz-hp34-8kcx | Improper Certificate Validation Signature validation bypass in simplesamlphp. |
201710-01
|
| VCID-mfwu-mfhq-fkh8 | Improper Verification of Cryptographic Signature A SimpleSAMLphp Service Provider using SAML will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid. Attributes contained in all the assertions received will be merged and the entityID of the first assertion received will be used, allowing an attacker to impersonate any user of any IdP given an assertion signed by the targeted IdP. |
CVE-2017-18122
GHSA-j4qf-3w33-8cgc |
| VCID-ugw3-xgan-k3fm | Duplicate Advisory: SimpleSAMLphp signature validation bypass A signature validation bypass issue has been found in the `SimpleSAML_XML_Validator` class. This class performs the verification of the XML digital signature of a SAML 1 message with a given key. When a SAML 1 authentication response message is received, it is processed to verify its authenticity, including a check for the signature or signatures included in the message. If the message is not signed but the assertions contained in it are, the signatures of those assertions signed will be verified. Unsigned assertions will not be verified. After verifying every signed element in the response, a list of valid nodes is built, holding the DOM nodes of those XML elements that are signed and whose signatures have been successfully verified. Once this list is built, the assertions need to be processed individually. They are not processed until the getAttributes() method of the SimpleSAML_XML_Shib13_AuthnResponse class is called. This method iterates through the list of assertions contained in the response and makes sure they were validated in the previous signature verification step, by checking if their corresponding DOM nodes are in the list of those verified. The vulnerability is due to lax comparison of the node being checked and the nodes in the verified list. The isNodeValidated() method of the SimpleSAML_XML_Validator class checks if a given DOM node is in the validNodes array by means of the standard in_array() function. This function, however, will return unexpected results due to the default lax behaviour when checking data types in PHP. In this case, the fact that there is a DOM node in the list is enough for in_array() to return true when looking for any DOM node. This means any unsigned assertion will be considered verified if there is at least one assertion with a valid signature in the message being processed. This issue allows an attacker to generate a SAML 1 authentication response that contains two different assertions. The first assertion is the one the attacker wants the Service Provider to use, with custom attributes, expiration and even entityID (provided that the given entityID belongs to an Identity Provider that the Service Provider knows and trusts). The second is a legitimate assertion issued and signed by an Identity Provider trusted by the Service Provider. If the second assertion is still valid when sent by the attacker, SimpleSAMLphp will merge all the attributes found in both assertions, but the entityID registered for the authenticating third-party will be the one found in the first, tampered assertion. If the second (legitimate) assertion is already expired when the attacker sends it, only the attributes found in the tampered assertion will be used. The issue can be easily fixed by passing a third parameter to the in_array() function, telling it to perform strict comparisons when checking if an object is found inside a given array. This way, when the code evaluates if the tampered assertion is included in the list of verified assertions, it fails and only the legitimate assertion is used, if possible (e.g. it is not expired). |
GHSA-fjr2-r2mp-484p
|