SimpleSAMLphp Reflected Cross-site Scripting Vulnerability in simplesamlphp/simplesamlphp
Summary
GHSA-vpr3-cw3h-prw8: SimpleSAMLphp Reflected Cross-site Scripting vulnerability. Affects simplesamlphp/simplesamlphp versions >= 1.12.0, < 1.17.3. Fixed in 1.17.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source PHP-based application that provides a set of libraries and modules for implementing SAML-based authentication and federation. It is commonly used in identity and access management systems to enable single sign-on (SSO) functionality. SimpleSAMLphp utilizes metadata to determine how to interact with other SAML entities, including endpoints where SAML messages can be sent.
Vulnerability Detail
The vulnerability in SimpleSAMLphp is a reflected cross-site scripting (XSS) issue. When sending a SAML message to another entity, SimpleSAMLphp retrieves the target URL from the stored metadata for that entity. However, if the metadata has been tampered with by a malicious party, the URLs of the endpoints can be substituted with JavaScript code. SimpleSAMLphp blindly uses these URLs without validation, leading to the execution of the injected JavaScript code in the end user's browser. This vulnerability affects all versions of SimpleSAMLphp up to 1.17.2.
How To Fix
Minimum fixed version
1.17.3
This is the first release that contains the fix.
composer require simplesamlphp/simplesamlphp:1.17.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement a strict Content Security Policy (CSP) that forbids inline JavaScript execution. By configuring the CSP to disallow inline scripts, the impact of the XSS vulnerability can be mitigated. Here is an example of a Content Security Policy header that can be added to the web server configuration:
Content-Security-Policy: script-src 'self';
Conclusion
The SimpleSAMLphp Reflected Cross-site Scripting vulnerability allows for the execution of malicious JavaScript code in the end user's browser if the metadata is tampered with. To mitigate this vulnerability, it is recommended to upgrade to SimpleSAMLphp version 1.17.3 or later. Implementing a strict Content Security Policy (CSP) can also provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simplesamlphp/simplesamlphp →
FAQ
SimpleSAMLphp is an open-source PHP-based application used for implementing SAML-based authentication and federation in identity and access management systems.
If a rogue entity's metadata containing JavaScript code in the endpoints is consumed by SimpleSAMLphp, the injected code may be executed in the end user's browser, potentially leading to unauthorized actions or information disclosure.
Upgrade SimpleSAMLphp to version 1.17.3 or later, which includes a fix for the XSS vulnerability by implementing proper validation and sanitization of the endpoint URLs in the metadata.
Yes, all versions of SimpleSAMLphp up to 1.17.2 are affected by this reflected XSS vulnerability.
Yes, as a temporary workaround, users can implement a strict Content Security Policy (CSP) that disallows inline JavaScript execution. This can help mitigate the impact of the XSS vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/simplesamlphp.
