LightSAML Incorrect Access Control vulnerability in lightsaml/lightsaml
Summary
CVE-2018-1000165: LightSAML Incorrect Access Control vulnerability. Affects lightsaml/lightsaml versions < 1.3.5. Fixed in 1.3.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
LightSAML is a package available on Packagist that provides functionality for handling SAML (Security Assertion Markup Language) in PHP applications. It allows applications to communicate with Identity Providers and handle authentication and authorization processes. However, prior to version 1.3.5, LightSAML is vulnerable to an Incorrect Access Control issue in the signature validation process. This vulnerability can lead to the impersonation of any user from the Identity Provider, potentially compromising the security of the application.
Vulnerability Detail
The Incorrect Access Control vulnerability in LightSAML arises from a flaw in the signature validation process within the src/LightSaml/Model/XmlDSig/ readers. This flaw allows an attacker to impersonate any user from the Identity Provider. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive information or perform actions on behalf of other users. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level. The issue has been addressed in version 1.3.5 and later of LightSAML.
How To Fix
Minimum fixed version
1.3.5
This is the first release that contains the fix.
composer require lightsaml/lightsaml:1.3.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating to the fixed version is the recommended solution.
Conclusion
The LightSAML package prior to version 1.3.5 is vulnerable to an Incorrect Access Control issue that can lead to impersonation of users from the Identity Provider. It is crucial to update the package to version 1.3.5 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for lightsaml/lightsaml →
FAQ
LightSAML is a PHP package that provides functionality for handling SAML in applications, allowing communication with Identity Providers and managing authentication and authorization processes.
The vulnerability allows an attacker to impersonate any user from the Identity Provider, potentially gaining unauthorized access to sensitive information or performing actions on behalf of other users.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix the vulnerability, update the LightSAML package to version 1.3.5 or later and ensure the correct implementation and configuration of the signature validation process.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vg4f-8v9q-5c3x/GHSA-vg4f-8v9q-5c3x.json
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
