Vulnerability in php-cas - Security Update
Summary
DLA-3485-1: php-cas - security update. Affects php-cas versions < 1.3.6-1+deb10u1. Fixed in 1.3.6-1+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php-cas is a Central Authentication Service (CAS) client library in PHP. It provides functionality for integrating applications with CAS servers for single sign-on authentication. The library allows users to authenticate once and access multiple services without the need for repeated logins. However, a vulnerability has been discovered in php-cas that could potentially allow an attacker to gain unauthorized access to a victim's account on a vulnerable CASified service. This can occur when the victim visits the attacker's website while being logged in to the same CAS server.
Vulnerability Detail
The vulnerability in php-cas arises from the library's use of HTTP headers to determine the service URL used to validate tickets. This allows an attacker to manipulate the host header and use a valid ticket granted for any authorized service in the same SSO realm (CAS server) to authenticate to the service protected by php-cas. The impact of this vulnerability depends on the configuration of the CAS server service registry. In the worst case, an attacker may be able to authenticate to any other service URL if the allowed URLs are not properly restricted. In other cases, the vulnerability may be limited to known and authorized services within the same SSO federation if proper URL service validation is applied.
How To Fix
Minimum fixed version
1.3.6-1+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-casTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround is available for this vulnerability. It is necessary to update the software using php-cas to the fixed version.
Conclusion
The vulnerability in php-cas can potentially allow unauthorized access to user accounts on vulnerable CASified services. It is crucial to update the software using php-cas to the fixed version to mitigate this vulnerability. For Debian 10 buster, the packages in the Debian repositories have been updated, but additional manual configuration may be required. Third-party software using php-cas should follow the instructions provided by the upstream project for updating. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php-cas →
FAQ
php-cas is a Central Authentication Service (CAS) client library in PHP. It allows applications to integrate with CAS servers for single sign-on authentication.
The vulnerability in php-cas can potentially allow an attacker to gain unauthorized access to a victim's account on a vulnerable CASified service.
The vulnerability arises from the use of HTTP headers in php-cas to determine the service URL used to validate tickets. An attacker can manipulate the host header and use a valid ticket granted for any authorized service in the same SSO realm to authenticate to the service protected by php-cas.
To fix this vulnerability, it is necessary to update the software using php-cas to the fixed version. Instructions for updating are provided by the upstream project.
No, there is no workaround available for this vulnerability. Updating the software to the fixed version is necessary.
Related vulnerabilities
Recent vulnerabilities recorded for php-cas.
