Key Confusion Vulnerability in SimpleSAMLphp: Signature Verification Flaw
Summary
CVE-2018-7644: The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Iden... Affects simplesamlphp across 2 version ranges.
< 1.15.3-1
< 1cba48676420d7889ba8223d4f2ea1b9867c0184
Fixed in 1.15.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source application written in PHP that facilitates the implementation of SAML (Security Assertion Markup Language) for single sign-on (SSO) solutions. It allows web applications to authenticate users through various identity providers. The package is widely used for its ease of integration and support for multiple authentication mechanisms. However, a critical vulnerability exists in its use of the XmlSecLibs library, which can lead to improper signature verification on SAML assertions.
Vulnerability Detail
The vulnerability, identified as CVE-2018-7644, arises from the XmlSecLibs library used in the SimpleSAMLphp package. It incorrectly verifies signatures on SAML assertions, enabling a remote attacker to create a crafted SAML assertion that appears cryptographically valid. This flaw allows the attacker to impersonate a user from a legitimate Identity Provider, leading to unauthorized access and potential data breaches. The issue is categorized as a key confusion problem, which can have serious implications for user security and trust.
How To Fix
Minimum fixed version
1.15.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade simplesamlphpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing additional security measures such as restricting access to the SAML endpoints and closely monitoring authentication logs for any suspicious activity. However, these are temporary measures and do not replace the need for an upgrade.
Conclusion
CVE-2018-7644 presents a significant risk to users of SimpleSAMLphp due to its flawed signature verification process. Immediate action is required to upgrade to the fixed version to mitigate the risk of impersonation and unauthorized access. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for simplesamlphp →
FAQ
CVE-2018-7644 is a vulnerability in the SimpleSAMLphp package that allows attackers to impersonate users by exploiting improper signature verification on SAML assertions.
You can use Vulert, which monitors open-source vulnerabilities in software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
The main consequence is unauthorized access, where an attacker can impersonate legitimate users, potentially leading to data breaches and loss of user trust.
Yes, upgrading to SimpleSAMLphp version 1.15.3 or later addresses this vulnerability.
Implement temporary security measures such as restricting access to SAML endpoints and monitoring authentication logs, but prioritize upgrading as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp.
