CVE-2018-6521: SimpleSAMLphp Use of insecure connection charset (sqlauth module)
Summary
CVE-2018-6521: SimpleSAMLphp Use of insecure connection charset (sqlauth module). Affects simplesamlphp/simplesamlphp versions < 1.15.2. Fixed in 1.15.2. How to fix ↓
Also tracked for
- simplesamlphp · Debian:11
The same CVE-2018-6521 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is a PHP-based authentication and federation application. It provides support for SAML-based single sign-on (SSO) and is widely used in various web applications. The sqlauth module in SimpleSAMLphp versions prior to 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. This vulnerability may allow remote attackers to bypass intended access restrictions.
Vulnerability Detail
The sqlauth module in SimpleSAMLphp before version 1.15.2 uses an insecure connection charset, which can lead to query truncation when encountering four-byte characters. This can potentially be exploited by remote attackers to bypass access restrictions. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
1.15.2
This is the first release that contains the fix.
composer require simplesamlphp/simplesamlphp:1.15.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to manually modify the sqlauth module to use a connection charset that supports four-byte characters, such as utf8mb4. This can be done by editing the relevant configuration files and modifying the charset settings. However, it is strongly advised to upgrade to the latest version as soon as possible to ensure a comprehensive fix.
Conclusion
The sqlauth module in SimpleSAMLphp versions prior to 1.15.2 is vulnerable to an insecure connection charset issue, which can be exploited by remote attackers to bypass access restrictions. It is critical to upgrade to version 1.15.2 or later to fix this vulnerability. If immediate upgrade is not possible, a temporary workaround is available, but upgrading to the latest version is strongly advised. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simplesamlphp/simplesamlphp →
FAQ
SimpleSAMLphp is a PHP-based authentication and federation application used for SAML-based single sign-on (SSO). It provides a framework for implementing SSO solutions in web applications.
The sqlauth module is a component of SimpleSAMLphp that allows authentication against a SQL database. It is commonly used for integrating SimpleSAMLphp with existing user databases.
This vulnerability in the sqlauth module can potentially allow remote attackers to bypass access restrictions. By exploiting the insecure connection charset, attackers may be able to execute unauthorized queries and gain unauthorized access to sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
A possible workaround is to manually modify the sqlauth module to use a connection charset that supports four-byte characters, such as utf8mb4. However, it is strongly recommended to upgrade to the latest version of SimpleSAMLphp to ensure a comprehensive fix.
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/simplesamlphp.
