Credentials Exposure in SimpleSAMLphp
Summary
GHSA-7wh8-jrq7-p27f: SimpleSAMLphp exposes credentials in session storage. Affects simplesamlphp/simplesamlphp versions >= 1.16.0, < 1.16.3. Fixed in 1.16.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SimpleSAMLphp is an open-source PHP library that provides support for the SAML (Security Assertion Markup Language) protocol. It enables organizations to implement Single Sign-On (SSO) authentication and authorization across multiple systems. The library allows users to authenticate once and access multiple applications without the need for separate login credentials. However, a vulnerability has been discovered in SimpleSAMLphp that exposes user credentials in session storage.
Vulnerability Detail
The vulnerability arises from the implementation of the SAML Enhanced Client or Proxy (ECP) profile in SimpleSAMLphp. When an authentication request is received via the ECP profile, the username and password obtained are stored in the state array. If the ECP profile is disabled, but metadata for an entity that supports ECP is present, the credentials are still saved to the user's session, which can be stored in permanent storage such as the local file system or a remote memcache or database server. This exposes the credentials to potential unauthorized access by administrators, other personnel, or malicious parties who have access to the session storage.
How To Fix
Minimum fixed version
1.16.3
This is the first release that contains the fix.
composer require simplesamlphp/simplesamlphp:1.16.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround is to enable the ECP profile in the Identity Provider (IdP) configuration. By enabling ECP, the credentials obtained via the ECP profile will be handled correctly and not stored in the user's session. However, this workaround may not be suitable for all environments and should be evaluated carefully.
Conclusion
The vulnerability in SimpleSAMLphp exposes user credentials in session storage, potentially allowing unauthorized access to sensitive information. To mitigate this risk, it is crucial to upgrade to SimpleSAMLphp version 1.16.3 or later. Alternatively, enabling the ECP profile in the IdP configuration can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simplesamlphp/simplesamlphp →
FAQ
SimpleSAMLphp is an open-source PHP library for implementing the SAML protocol, enabling Single Sign-On authentication across multiple systems.
The ECP profile is a SAML profile that allows clients to authenticate to an Identity Provider (IdP) using SOAP or PAOS bindings. It enhances the SAML protocol by providing additional features such as proxying and enhanced security.
When the ECP profile is disabled in the IdP, but metadata for an entity that supports ECP is present, SimpleSAMLphp incorrectly stores the credentials obtained via the ECP profile in the user's session. This session can be stored in permanent storage, potentially exposing the credentials to unauthorized access.
The vulnerability allows administrators, other personnel, or malicious parties with access to the session storage to potentially obtain user credentials. This can lead to unauthorized access to systems and sensitive information.
Upgrading to SimpleSAMLphp version 1.16.3 or later will fix the vulnerability. It is recommended to promptly upgrade to the latest version to ensure the security of user credentials.
References
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/simplesamlphp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
