Cross-Site Scripting Vulnerability in SimpleSAMLphp Package
Summary
DEBIAN-CVE-2020-5226: Cross-site scripting in SimpleSAMLphp before version 1.18.4. Affects simplesamlphp versions < 1.18.4-1. Fixed in 1.18.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SimpleSAMLphp is an application written in PHP that facilitates authentication and federation for web applications. It provides a robust framework for implementing SAML (Security Assertion Markup Language) authentication, allowing users to log in to multiple applications with a single set of credentials. The package is widely used in various environments for its ease of integration and flexibility. However, it has been identified to have a cross-site scripting (XSS) vulnerability that can be exploited if not addressed.
Vulnerability Detail
The vulnerability arises from the www/erroreport.php script in SimpleSAMLphp versions prior to 1.18.4. This script allows users to submit error reports, which are then sent to the system administrator. A new email handling class was introduced in version 1.18.0 that uses Twig templates for email formatting, which automatically escapes variables. However, for users not utilizing the new interface, a hardcoded email template in plain PHP lacks escaping, allowing attackers to inject HTML into the email by manipulating the free-text field in the error report. This can lead to XSS attacks, where malicious scripts are executed in the context of the user's browser.
How To Fix
Minimum fixed version
1.18.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade simplesamlphpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to disable the error reporting feature in the application until the package can be updated. This can be done by modifying the configuration settings to prevent users from submitting error reports.
Conclusion
The identified cross-site scripting vulnerability in SimpleSAMLphp poses significant risks to applications utilizing this package. It is crucial to update to the latest version to safeguard against potential exploits. Users are encouraged to leverage tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for simplesamlphp →
FAQ
SimpleSAMLphp is a PHP-based application that provides authentication and federation services using SAML, enabling single sign-on capabilities for web applications.
The vulnerability allows for cross-site scripting (XSS) attacks through the error reporting feature, enabling attackers to inject malicious HTML into emails sent from the application.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized script execution in users' browsers, potentially compromising user data and application integrity.
Yes, temporarily disabling the error reporting feature can mitigate the risk until the package is updated to a secure version.
References
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
