CVE-2017-12874: SimpleSAMLphp InfoCard module Incorrect signature verification
Summary
CVE-2017-12874: SimpleSAMLphp InfoCard module Incorrect signature verification. Affects simplesamlphp/simplesamlphp-module-infocard versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Also tracked for
- simplesamlphp · Debian:11
The same CVE-2017-12874 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source PHP library that provides support for the SAML (Security Assertion Markup Language) protocol. It is widely used for implementing Single Sign-On (SSO) solutions. The InfoCard module is an extension for SimpleSAMLphp that enables the use of InfoCard authentication. InfoCard is a Microsoft technology that allows users to authenticate to web services using digital identities stored on their computers. The module is affected by a vulnerability that allows attackers to spoof XML messages by exploiting an incorrect check of return values in signature validation utilities.
Vulnerability Detail
The vulnerability in the SimpleSAMLphp InfoCard module arises from an incorrect check of return values in signature validation utilities. This flaw can be exploited by an attacker to spoof XML messages, potentially leading to various security issues. By crafting malicious XML messages with incorrect signatures, an attacker can deceive the system into accepting and processing these messages as valid. This can result in unauthorized access, data tampering, or other malicious activities depending on the context in which the module is used.
How To Fix
Minimum fixed version
1.0.1
This is the first release that contains the fix.
composer require simplesamlphp/simplesamlphp-module-infocard:1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the module to the fixed version as soon as possible.
Conclusion
The SimpleSAMLphp InfoCard module is affected by a vulnerability that allows attackers to spoof XML messages. To mitigate this risk, it is recommended to update the module to version 1.0.1 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simplesamlphp/simplesamlphp-module-infocard →
FAQ
SimpleSAMLphp is an open-source PHP library used for implementing Single Sign-On (SSO) solutions.
The InfoCard module is an extension for SimpleSAMLphp that enables the use of InfoCard authentication, a Microsoft technology for web service authentication.
This vulnerability allows attackers to spoof XML messages, potentially leading to unauthorized access, data tampering, or other malicious activities.
To fix this vulnerability, update the SimpleSAMLphp InfoCard module to version 1.0.1 or later.
No, there is no known workaround. It is crucial to update the module to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/simplesamlphp-module-infocard.
