CVE-2017-12870: SimpleSAMLphp Unauthenticated encryption in CBC mode
Summary
CVE-2017-12870: SimpleSAMLphp Unauthenticated encryption in CBC mode. Affects simplesamlphp/simplesamlphp versions < 1.14.13. Fixed in 1.14.13. How to fix ↓
Also tracked for
- simplesamlphp · Debian:11
The same CVE-2017-12870 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is a PHP-based application that provides a set of libraries and modules for implementing SAML-based authentication and federation. It is commonly used in web applications to enable single sign-on (SSO) functionality. The vulnerability identified as CVE-2017-12870 affects SimpleSAMLphp versions 1.14.12 and earlier. This vulnerability arises from the improper use of encryption in Cipher Block Chaining (CBC) mode, specifically in the aesEncrypt and aesDecrypt methods of the SimpleSAML\Utils\Crypto class. The vulnerability allows an attacker positioned as a man-in-the-middle to intercept and obtain sensitive information, such as session identifiers, when replies are sent to non-HTTPS service providers.
Vulnerability Detail
The vulnerability in SimpleSAMLphp arises due to the improper implementation of encryption in CBC mode. By leveraging the aesEncrypt and aesDecrypt methods, an attacker can intercept and decrypt sensitive information transmitted between the application and non-HTTPS service providers. This can lead to the exposure of session identifiers and other confidential data, potentially compromising the security of user sessions and allowing unauthorized access to protected resources. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.14.13
This is the first release that contains the fix.
composer require simplesamlphp/simplesamlphp:1.14.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to enforce the use of HTTPS for all communication between SimpleSAMLphp and service providers. By ensuring that all replies are transmitted over a secure HTTPS connection, the vulnerability can be mitigated. This can be achieved by configuring the web server hosting SimpleSAMLphp to enforce HTTPS and redirect any HTTP requests to HTTPS. Below is an example configuration for Apache web server:
<VirtualHost *:80>
ServerName simplesamlphp.example.com
Redirect permanent / https://simplesamlphp.example.com/
</VirtualHost>
<VirtualHost *:443>
ServerName simplesamlphp.example.com
DocumentRoot /var/www/simplesamlphp
...
</VirtualHost>
Conclusion
In conclusion, the vulnerability identified as CVE-2017-12870 in SimpleSAMLphp versions 1.14.12 and earlier exposes sensitive information to man-in-the-middle attacks due to unauthenticated encryption in CBC mode. To mitigate the vulnerability, it is crucial to upgrade SimpleSAMLphp to version 1.14.13 or later. Additionally, enforcing the use of HTTPS for communication with service providers can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simplesamlphp/simplesamlphp →
FAQ
SimpleSAMLphp is a PHP-based application that provides libraries and modules for implementing SAML-based authentication and federation. It enables web applications to support single sign-on (SSO) functionality.
SimpleSAMLphp versions 1.14.12 and earlier are affected by this vulnerability.
The vulnerability allows a man-in-the-middle attacker to intercept and obtain sensitive information, such as session identifiers, transmitted between SimpleSAMLphp and non-HTTPS service providers. This can lead to unauthorized access to user sessions and compromise the security of protected resources.
To fix the vulnerability, it is recommended to upgrade SimpleSAMLphp to version 1.14.13 or later. This version includes the necessary fixes to address the encryption vulnerability.
As a temporary workaround, enforcing the use of HTTPS for all communication between SimpleSAMLphp and service providers can mitigate the vulnerability. This can be achieved by configuring the web server to enforce HTTPS and redirect HTTP requests to HTTPS.
References
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/simplesamlphp.
