SimpleSAMLphp signature validation bypass in simplesamlphp/simplesamlphp
Summary
GHSA-fjr2-r2mp-484p: SimpleSAMLphp signature validation bypass. Affects simplesamlphp/simplesamlphp versions >= 1.12.0, < 1.14.17. Fixed in 1.14.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source PHP library that provides support for the SAML (Security Assertion Markup Language) protocol. It is commonly used as a Service Provider (SP) in SAML-based Single Sign-On (SSO) systems. SimpleSAMLphp allows users to authenticate once and access multiple applications without the need for separate login credentials. This vulnerability affects SimpleSAMLphp versions before and including 1.14.16.
Vulnerability Detail
The vulnerability in SimpleSAMLphp allows an attacker to bypass signature validation in SAML authentication response messages. When a SAML 1 authentication response message is received, SimpleSAMLphp verifies the signatures of the assertions contained in the message. However, due to a lax comparison of the verified nodes, an attacker can include a tampered assertion along with a legitimate assertion. If the tampered assertion is not expired, SimpleSAMLphp will merge the attributes from both assertions, but use the entityID from the tampered assertion. If the legitimate assertion is expired, only the attributes from the tampered assertion will be used. This allows the attacker to impersonate any user from any SAML 1 Identity Provider trusted by the SimpleSAMLphp Service Provider.
How To Fix
Minimum fixed version
1.14.17
This is the first release that contains the fix.
composer require simplesamlphp/simplesamlphp:1.14.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The SimpleSAMLphp signature validation bypass vulnerability allows an attacker to impersonate users from trusted Identity Providers. It is crucial to upgrade to the latest version of SimpleSAMLphp or apply the provided patch to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for simplesamlphp/simplesamlphp →
FAQ
All SimpleSAMLphp versions before and including 1.14.16 are affected.
An attacker can impersonate any user from any SAML 1 Identity Provider trusted by the SimpleSAMLphp Service Provider.
Upgrade to the latest version of SimpleSAMLphp or apply the provided patch.
No, there is no known workaround.
For more information, you can refer to the vulnerability details provided by the SimpleSAMLphp project.
References
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/simplesamlphp.
