PT-2017-12743 · Simplesamlphp · Simplesamlphp

Jaimeperez · Publicado 2017-09-01 · Atualizado 2020-01-24 · CVE-2017-12873

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions 1.7.0 through 1.14.10

Description The issue arises when a SimpleSAMLphp Identity Provider is misconfigured, leading to incorrect persistent NameID generation. This can cause different users to receive the same identifier, potentially allowing attackers to obtain sensitive information or gain unauthorized access. The problem occurs when the SimpleSAML Auth ProcessingChain class attempts to keep a unique user identifier in the state array, but fails due to missing or empty attributes. As a result, all users connecting to a given service provider may receive the same NameID, which can be used to identify users across sessions. Some service providers have already observed cases where this issue has led to security problems.

Recommendations Upgrade to the latest version. Configure a saml:PersistentNameID authentication processing filter according to your needs, ensuring the attribute used as the source for the NameID is present, unique per user, and does not change over time.

Exploit

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2017-12873

DLA-1205-1

DSA-4127-1

GHSA-GP2M-7CFP-H6GF

Produtos afetados

Simplesamlphp

Referências · 29

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2017-12873.yaml · Exploit
• https://github.com/simplesamlphp/simplesamlphp/commit/90dca835158495b173808273e7df127303b8b953 · Correção
• https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-gp2m-7cfp-h6gf · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12873 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18121 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12867 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-12873 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12873 · Nota
• https://osv.dev/vulnerability/DSA-4127-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7644 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6521 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2017-12873 · Nota de Segurança
• https://packages.debian.org/src:simplesamlphp · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12874 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12873 · Nota de Segurança