Signature-Validation Bypass in SimpleSAMLphp: CVE-2017-18122
Summary
CVE-2017-18122: A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. Affects simplesamlphp across 2 version ranges.
< 1.15.0-1
< 9ebbbbc7fa334d55526c2a5e230d9941002cdcb8
Fixed in 1.15.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source application written in PHP that facilitates the implementation of SAML (Security Assertion Markup Language) authentication. It allows service providers to authenticate users through identity providers, enabling single sign-on (SSO) capabilities. The application is widely used for its flexibility and ease of integration with various identity providers. However, it is vulnerable to a signature-validation bypass issue that can lead to serious security risks.
Vulnerability Detail
A signature-validation bypass issue was discovered in SimpleSAMLphp versions up to 1.14.16. The vulnerability allows a SimpleSAMLphp Service Provider using SAML 1.1 to accept any unsigned SAML response that contains more than one signed assertion, as long as at least one of the assertions is validly signed. This flaw enables an attacker to impersonate any user from any Identity Provider (IdP) if they can obtain a valid assertion signed by that IdP. The implications of this vulnerability are severe, as it compromises the integrity of user authentication and can lead to unauthorized access to sensitive resources.
How To Fix
Minimum fixed version
1.15.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade simplesamlphpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is recommended to disable the acceptance of unsigned SAML responses until the upgrade can be performed. This can be done by modifying the configuration settings in your SimpleSAMLphp installation to enforce strict signature validation.
Conclusion
CVE-2017-18122 represents a significant security risk for users of SimpleSAMLphp, allowing attackers to bypass signature validation and impersonate users. It is crucial to upgrade to version 1.15.0-1 or later to mitigate this vulnerability. In the meantime, applying the suggested workaround can help protect your application.
See every vulnerability recorded for simplesamlphp →
FAQ
CVE-2017-18122 is a vulnerability in SimpleSAMLphp that allows for a signature-validation bypass, enabling attackers to impersonate users.
Versions of SimpleSAMLphp up to 1.14.16 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2017-18122 is 8.1, indicating a high severity level.
If an immediate upgrade is not possible, implement the recommended workaround by disabling the acceptance of unsigned SAML responses.
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp.
