Session Fixation Vulnerability in SimpleSAMLphp: CVE-2017-12868
Summary
CVE-2017-12868: The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by l... Affects simplesamlphp across 2 version ranges.
< 1.14.15-1
< 4bc629658e7b7d17c9ac3fe0da7dc5df71f1b85e
Fixed in 1.14.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source application written in PHP that provides a simple way to implement SAML authentication. It is widely used for enabling single sign-on (SSO) capabilities in web applications. The package allows developers to integrate SAML-based authentication into their applications, making it easier for users to access multiple services with a single set of credentials. However, certain versions of SimpleSAMLphp are vulnerable to session fixation attacks due to flaws in the secureCompare method, particularly in versions prior to 1.14.15.
Vulnerability Detail
The vulnerability identified as CVE-2017-12868 arises from the secureCompare method in the lib/SimpleSAML/Utils/Crypto.php file of SimpleSAMLphp versions 1.14.13 and earlier. When used with PHP versions prior to 5.6, this method lacks proper character conversions before performing an XOR operation. This oversight allows attackers to exploit the vulnerability, potentially conducting session fixation attacks or bypassing authentication altogether. The ramifications of this vulnerability can lead to unauthorized access to user sessions and sensitive information.
How To Fix
Minimum fixed version
1.14.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade simplesamlphpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing the following workaround: Ensure that your application is running on PHP version 5.6 or higher, as this may mitigate some risks associated with the vulnerability. However, this is not a complete fix and upgrading is strongly recommended.
Conclusion
CVE-2017-12868 is a critical vulnerability in SimpleSAMLphp that poses significant risks to applications using affected versions. It is crucial to upgrade to version 1.14.15 or later to mitigate these risks. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for simplesamlphp →
FAQ
CVE-2017-12868 is a vulnerability in SimpleSAMLphp that allows session fixation attacks due to flaws in the secureCompare method.
SimpleSAMLphp versions 1.14.13 and earlier are affected by this vulnerability.
The vulnerability can lead to unauthorized access to user sessions, allowing attackers to impersonate users and access sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2017-12868 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp.
