Vulnerability in simplesamlphp - Cross Site Scripting (XSS), Signature Validation Bypass, and Insecure Connection Charset
Summary
DLA-1273-1: simplesamlphp - security update. Affects simplesamlphp versions < 1.9.2-1+deb7u2. Fixed in 1.9.2-1+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
simplesamlphp is an authentication and federation application that provides a framework for implementing Single Sign-On (SSO) solutions. It is widely used for identity management and authentication in various web applications. However, the application has been found vulnerable to multiple security issues, including Cross Site Scripting (XSS), signature validation bypass, and using an insecure connection charset.
Vulnerability Detail
The first vulnerability, identified as CVE-2017-18121, is a Cross Site Scripting (XSS) issue in the consentAdmin module of SimpleSAMLphp through version 1.14.15. This vulnerability allows an attacker to craft malicious links that, when clicked by a victim, execute arbitrary JavaScript code.
The second vulnerability, CVE-2017-18122, is a signature-validation bypass issue in SimpleSAMLphp through version 1.14.16. In SAML 1.1, a Service Provider will consider any unsigned SAML response containing more than one signed assertion as valid, as long as the signature of at least one assertion is valid. This allows an attacker to impersonate any user of any Identity Provider (IdP) by presenting an assertion signed by the targeted IdP.
The third vulnerability, CVE-2018-6521, affects the sqlauth module in SimpleSAMLphp before version 1.15.2. The module relies on the MySQL utf8 charset, which truncates queries when encountering four-byte characters. This can potentially allow remote attackers to bypass intended access restrictions.
How To Fix
Minimum fixed version
1.9.2-1+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade simplesamlphpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
In conclusion, simplesamlphp is vulnerable to Cross Site Scripting (XSS), signature validation bypass, and insecure connection charset issues. It is crucial to upgrade to the latest version of simplesamlphp to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for simplesamlphp →
FAQ
Cross Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or performing actions on behalf of the victim.
The signature-validation bypass vulnerability in SimpleSAMLphp allows an attacker to present a signed assertion from a targeted Identity Provider (IdP) and impersonate any user of that IdP. This is possible because the Service Provider considers any unsigned SAML response containing multiple signed assertions as valid, as long as the signature of at least one assertion is valid.
The sqlauth module vulnerability in SimpleSAMLphp can potentially allow remote attackers to bypass intended access restrictions. This occurs due to the truncation of queries when encountering four-byte characters in the MySQL utf8 charset.
You can use Vulert's playground at Vulert Scanner to check if your SimpleSAMLphp installation is affected by these vulnerabilities. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
