Authentication Bypass Vulnerability in SimpleSAMLphp: CVE-2017-12869
Summary
CVE-2017-12869: The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to im... Affects simplesamlphp across 2 version ranges.
< 1.14.15-1
< 5af1eea090cd15f1e560f5d6f459c1e7d1942a21
Fixed in 1.14.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source application written in PHP that facilitates Single Sign-On (SSO) and federated authentication. It is widely used for managing user authentication across various applications and services. The multiauth module in SimpleSAMLphp allows for multiple authentication sources, but it has been found to have a critical vulnerability that can lead to unauthorized access.
Vulnerability Detail
The vulnerability identified as CVE-2017-12869 affects versions 1.14.13 and earlier of the multiauth module in SimpleSAMLphp. It allows remote attackers to bypass authentication context restrictions, enabling them to utilize an authentication source defined in the config/authsources.php file. This flaw arises from improper validation of user input, which can lead to significant security risks, including unauthorized access to sensitive information and systems.
How To Fix
Minimum fixed version
1.14.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade simplesamlphpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider restricting access to the SimpleSAMLphp configuration files and implementing additional security measures, such as IP whitelisting or using a web application firewall (WAF) to mitigate potential attacks.
Conclusion
CVE-2017-12869 is a critical vulnerability in SimpleSAMLphp that can lead to serious security breaches if not addressed. Users are strongly advised to upgrade to the latest version to protect their systems from potential attacks. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for simplesamlphp →
FAQ
CVE-2017-12869 is a vulnerability in the multiauth module of SimpleSAMLphp that allows attackers to bypass authentication restrictions.
Versions 1.14.13 and earlier of SimpleSAMLphp are affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized access to applications and sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-12869 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp.
