CVE-2017-12868: SimpleSAMLphp Session Fixation Issue and Authentication Bypass

Background

SimpleSAMLphp is an open-source PHP library that provides a set of tools for implementing SAML-based authentication. It is widely used for single sign-on (SSO) solutions and identity federation. The library allows organizations to authenticate users across multiple systems using a single set of credentials. However, SimpleSAMLphp versions 1.14.13 and earlier are vulnerable to a session fixation issue and authentication bypass in the authcrypt module.

Vulnerability Detail

The vulnerability, identified as CVE-2017-12868, stems from a flaw in the secureCompare method within the Crypto.php file of SimpleSAMLphp. When used with PHP versions prior to 5.6, the method fails to perform necessary character conversions before an XOR operation. This oversight enables attackers to exploit session fixation attacks or potentially bypass authentication. By leveraging this vulnerability, an attacker could gain unauthorized access to protected resources or impersonate legitimate users.

composer require simplesamlphp/simplesamlphp:1.14.14

Workaround

If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented. The workaround involves manually applying the necessary character conversions before the XOR operation in the secureCompare method. Here is an example of the modified code:

// Original code
function secureCompare($a, $b) {
    $result = 0;
    for ($i = 0; $i < strlen($a); $i++) {
        $result |= ord($a[$i]) ^ ord($b[$i]);
    }
    return $result === 0;
}

// Modified code
function secureCompare($a, $b) {
    $result = 0;
    for ($i = 0; $i < strlen($a); $i++) {
        $result |= ord(utf8_encode($a[$i])) ^ ord(utf8_encode($b[$i])));
    }
    return $result === 0;
}

Conclusion

In conclusion, SimpleSAMLphp versions 1.14.13 and earlier are vulnerable to a session fixation issue and authentication bypass. Upgrading to version 1.14.14 or later is the recommended solution to mitigate the risk. If immediate upgrade is not possible, applying the provided workaround can serve as a temporary measure. For further assistance and support in addressing this vulnerability, please contact DevNack.com.

See every vulnerability recorded for simplesamlphp/simplesamlphp →

FAQ