Critical Vulnerability in SimpleSAMLphp: MySQL Charset Truncation Risk
Summary
CVE-2018-6521: The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. Affects simplesamlphp across 2 version ranges.
< 1.15.2-1
< d6d8df7297778317fbf07edc8d882ceb283715f0
Fixed in 1.15.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SimpleSAMLphp is an open-source application that provides a simple way to implement SAML authentication. It is widely used for enabling single sign-on (SSO) capabilities in web applications. The application relies on MySQL for data storage, and its sqlauth module is responsible for handling user authentication. However, a vulnerability exists in the way this module interacts with the MySQL utf8 charset, which can lead to unintended access restrictions being bypassed.
Vulnerability Detail
The sqlauth module in SimpleSAMLphp versions prior to 1.15.2 is vulnerable due to its reliance on the MySQL utf8 charset. This charset truncates queries when encountering four-byte characters, potentially allowing remote attackers to bypass intended access restrictions. The vulnerability can lead to unauthorized access to sensitive information, making it critical for users to address this issue promptly. The CVSS score for this vulnerability is 9.8, indicating a high severity level.
How To Fix
Minimum fixed version
1.15.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade simplesamlphpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider switching to a different database charset that does not truncate four-byte characters, such as utf8mb4. This can be done by executing the following SQL command: ALTER DATABASE your_database_name CHARACTER SET = utf8mb4 COLLATE = utf8mb4_unicode_ci; However, this is not a permanent solution and upgrading is strongly recommended.
Conclusion
The vulnerability in SimpleSAMLphp's sqlauth module poses a significant risk by allowing unauthorized access due to MySQL charset truncation. It is crucial for users to upgrade to version 1.15.2 or later to mitigate this risk. Temporary workarounds exist, but they do not replace the need for a proper fix.
See every vulnerability recorded for simplesamlphp →
FAQ
The vulnerability allows remote attackers to bypass access restrictions, potentially leading to unauthorized access to sensitive data.
All versions of SimpleSAMLphp prior to 1.15.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate upgrading is not possible, consider changing your database charset to utf8mb4 as a temporary workaround.
More details can be found in the CVE database under CVE-2018-6521 and related advisories.
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
