CVE-2018-7644: SimpleSAMLphp Improper Verification of Cryptographic Signature
Summary
CVE-2018-7644: SimpleSAMLphp Improper Verification of Cryptographic Signature. Affects simplesamlphp/saml2 across 3 version ranges.
< 1.10.5
>= 2.0, < 2.3.7
>= 3.0, < 3.1.3
Fixed in 1.10.5, 2.3.7 or 3.1.3, depending on the release line you run. How to fix ↓
Also tracked for
- simplesamlphp · Debian:11
The same CVE-2018-7644 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source PHP library used for implementing SAML-based authentication and federation. It provides functionality for both Identity Providers (IdPs) and Service Providers (SPs) to enable secure single sign-on (SSO) across multiple applications. The saml2 library within SimpleSAMLphp is responsible for handling SAML assertions and their verification. However, prior to version 1.15.3, the library incorrectly verifies signatures on SAML assertions, leading to a key confusion issue. This vulnerability allows a remote attacker to construct a crafted SAML assertion on behalf of an IdP that would pass as cryptographically valid, enabling them to impersonate a user from that IdP.
Vulnerability Detail
The vulnerability arises from the incorrect verification of signatures on SAML assertions in the XmlSecLibs library used by the saml2 library in SimpleSAMLphp. By exploiting this flaw, an attacker can create a malicious SAML assertion that appears to be valid, allowing them to impersonate a user from the affected IdP. This can lead to unauthorized access to sensitive information, privilege escalation, and potential compromise of the entire SSO system. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.10.51.10.5composer require simplesamlphp/saml2:1.10.5 -
>= 2.0, < 2.3.72.3.7composer require simplesamlphp/saml2:2.3.7 -
>= 3.0, < 3.1.33.1.3composer require simplesamlphp/saml2:3.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the affected SimpleSAMLphp saml2 library to the fixed versions mentioned above.
Conclusion
The SimpleSAMLphp saml2 library prior to version 1.15.3 is vulnerable to an improper verification of cryptographic signature issue. This can be exploited by an attacker to impersonate a user from an affected Identity Provider. To mitigate this vulnerability, it is recommended to update the SimpleSAMLphp saml2 library to the fixed versions mentioned above. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simplesamlphp/saml2 →
FAQ
SimpleSAMLphp is an open-source PHP library used for implementing SAML-based authentication and federation. It provides functionality for both Identity Providers (IdPs) and Service Providers (SPs) to enable secure single sign-on (SSO) across multiple applications.
The saml2 library is responsible for handling SAML assertions and their verification within SimpleSAMLphp. It is used by both IdPs and SPs to facilitate secure SSO.
This vulnerability allows a remote attacker to impersonate a user from an affected IdP by crafting a malicious SAML assertion. This can lead to unauthorized access to sensitive information, privilege escalation, and potential compromise of the entire SSO system.
To fix this vulnerability, update the SimpleSAMLphp saml2 library to the recommended fixed versions: 1.10.5 or later for versions 0.x, 2.3.7 or later for versions 2.x, and 3.1.3 or later for versions 3.x.
No, there is no known workaround for this vulnerability. It is crucial to update the affected SimpleSAMLphp saml2 library to the fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/saml2.
