Sensitive Information Exposure in SimpleSAMLphp - CVE-2017-12870
Summary
CVE-2017-12870: SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect... Affects simplesamlphp across 2 version ranges.
< 1.14.15-1
< 353a77be570b29f42812a44245947b4fb030a5da
Fixed in 1.14.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source application written in PHP that facilitates Single Sign-On (SSO) and federated identity management. It is widely used for integrating various authentication mechanisms and supports multiple protocols. The package is designed to simplify the implementation of SSO solutions for web applications. However, versions 1.14.12 and earlier are vulnerable to a man-in-the-middle attack, which can compromise sensitive session identifiers.
Vulnerability Detail
The vulnerability arises from the use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class, which are employed to protect session identifiers in replies sent to non-HTTPS service providers. This design flaw allows attackers to intercept and decrypt sensitive information, potentially leading to unauthorized access to user sessions and sensitive data. The vulnerability is classified with a CVSS score of 5.9, indicating a moderate level of risk.
How To Fix
Minimum fixed version
1.14.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade simplesamlphpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider configuring your service providers to use HTTPS. This will help mitigate the risk of man-in-the-middle attacks, although it is not a complete solution. Additionally, ensure that sensitive information is not transmitted over unencrypted channels.
Conclusion
CVE-2017-12870 poses a significant risk to users of SimpleSAMLphp versions 1.14.12 and earlier due to its susceptibility to man-in-the-middle attacks. It is crucial for users to upgrade to version 1.14.15-1 or later to ensure the security of their applications and protect sensitive information.
See every vulnerability recorded for simplesamlphp →
FAQ
CVE-2017-12870 is a vulnerability in SimpleSAMLphp that allows man-in-the-middle attackers to obtain sensitive information by exploiting the encryption methods used for session identifiers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to user sessions, allowing attackers to impersonate users and access sensitive information.
Yes, configuring your service providers to use HTTPS can help mitigate the risk, but it is recommended to upgrade to the fixed version for complete protection.
The CVSS score of CVE-2017-12870 is 5.9, indicating a moderate level of risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp.
