CVE-2017-18122: SimpleSAMLphp Signature validation bypass
Summary
CVE-2017-18122: SimpleSAMLphp Signature validation bypass. Affects simplesamlphp/simplesamlphp versions < 1.14.17. Fixed in 1.14.17. How to fix ↓
Also tracked for
- simplesamlphp · Debian:11
The same CVE-2017-18122 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source PHP library that provides support for the SAML (Security Assertion Markup Language) protocol. It is commonly used for implementing Single Sign-On (SSO) solutions. SimpleSAMLphp allows Service Providers (SPs) to authenticate users by interacting with Identity Providers (IdPs) using SAML assertions. The library handles the validation of these assertions to ensure their authenticity and integrity.
Vulnerability Detail
A signature-validation bypass vulnerability was discovered in SimpleSAMLphp through version 1.14.16. When a SimpleSAMLphp Service Provider using SAML 1.1 receives a SAML response containing multiple signed assertions, it will consider the response valid if at least one of the assertions has a valid signature. This allows an attacker to impersonate any user of any IdP by providing a signed assertion from the targeted IdP. The attributes from all received assertions will be merged, and the entityID of the first assertion received will be used.
How To Fix
Minimum fixed version
1.14.17
This is the first release that contains the fix.
composer require simplesamlphp/simplesamlphp:1.14.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the acceptance of unsigned SAML responses or configure the SP to only accept responses with a single signed assertion. This can be done by modifying the SimpleSAMLphp configuration file.
Conclusion
In conclusion, the SimpleSAMLphp library through version 1.14.16 is vulnerable to a signature-validation bypass issue. It is crucial to upgrade to version 1.14.17 or later to mitigate this vulnerability. If immediate upgrade is not possible, applying the recommended workaround can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simplesamlphp/simplesamlphp →
FAQ
SimpleSAMLphp is an open-source PHP library used for implementing Single Sign-On (SSO) solutions. It allows Service Providers (SPs) to authenticate users by interacting with Identity Providers (IdPs) using the SAML protocol.
This vulnerability allows an attacker to impersonate any user of any Identity Provider (IdP) by providing a signed assertion from the targeted IdP. The attacker can merge attributes from multiple assertions and use the entityID of the first assertion received.
To fix this vulnerability, it is recommended to upgrade SimpleSAMLphp to version 1.14.17 or later. This version includes a fix for the signature-validation bypass issue.
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the acceptance of unsigned SAML responses or configure the SP to only accept responses with a single signed assertion.
For more information about this vulnerability, you can refer to the GitHub advisory database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j4qf-3w33-8cgc/GHSA-j4qf-3w33-8cgc.json
References
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/simplesamlphp.
