Token Validity Manipulation in SimpleSAMLphp: CVE-2017-12867
Summary
CVE-2017-12867: The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset. Affects simplesamlphp across 2 version ranges.
< 1.14.15-1
< 0329e7fd0e9f356211a002f5b7c79da4543b5efe
Fixed in 1.14.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source application written in PHP that facilitates Single Sign-On (SSO) and federated identity management. It is widely used in educational institutions and organizations to enable secure access to multiple applications with a single set of credentials. The package is designed to be flexible and extensible, allowing integration with various identity providers. However, versions 1.14.14 and earlier are vulnerable to a security flaw that allows attackers to manipulate token validity.
Vulnerability Detail
The vulnerability arises from the SimpleSAML_Auth_TimeLimitedToken class, which allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset. This flaw can lead to unauthorized access, as attackers can exploit the extended token validity to gain access to sensitive resources without proper authentication. The vulnerability is particularly concerning as it affects the integrity of the authentication process, potentially allowing attackers to impersonate legitimate users.
How To Fix
Minimum fixed version
1.14.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade simplesamlphpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to restrict access to the secret token and monitor for any unauthorized attempts to manipulate token validity. Additionally, consider implementing additional authentication measures to enhance security until the upgrade can be performed.
Conclusion
CVE-2017-12867 represents a significant security risk for users of SimpleSAMLphp versions 1.14.14 and earlier. By allowing attackers to manipulate token validity, it compromises the integrity of the authentication process. Users are strongly encouraged to upgrade to version 1.14.15-1 or later to mitigate this vulnerability.
See every vulnerability recorded for simplesamlphp →
FAQ
CVE-2017-12867 is a vulnerability in SimpleSAMLphp that allows attackers to extend the validity of a secret token, potentially leading to unauthorized access.
Versions 1.14.14 and earlier of SimpleSAMLphp are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2017-12867 is 5.9, indicating a moderate level of severity.
If an immediate upgrade is not possible, restrict access to the secret token and implement additional security measures to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp.
