PT-2018-6687 · Simplesamlphp · Simplesamlphp

Matt Schwager · Publicado 2018-02-02 · Atualizado 2022-05-14 · CVE-2017-18122

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SimpleSAMLphp versions prior to 1.14.17

Description: A signature-validation bypass issue was discovered in SimpleSAMLphp. This issue allows an attacker to impersonate any user of any IdP given an assertion signed by the targeted IdP, by sending an unsigned SAML response containing more than one signed assertion. The attributes contained in all the assertions received will be merged and the entityID of the first assertion received will be used.

Recommendations: For SimpleSAMLphp versions prior to 1.14.17, update to version 1.14.17 or later to resolve the issue. As a temporary workaround, consider disabling SAML 1.1 support in the SimpleSAMLphp Service Provider until a patch is available. Restrict access to the SAML response processing module to minimize the risk of exploitation. Avoid using unsigned SAML responses in the affected API endpoint until the issue is resolved.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2017-18122

DLA-1273-1

DSA-4127-1

GHSA-J4QF-3W33-8CGC

Produtos afetados

Simplesamlphp

Referências · 28

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2017-18122.yaml · Exploit
• https://github.com/simplesamlphp/simplesamlphp · Nota
• https://github.com/simplesamlphp/simplesamlphp/commit/e2d53086abbb253efb24ddcb49b116246eb0b6ca · Nota
• https://simplesamlphp.org/security/201710-01 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18121 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-18122 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12867 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18122 · Nota
• https://cve.org/CVERecord?id=CVE-2017-18122 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-4127-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7644 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6521 · Nota de Segurança
• https://packages.debian.org/src:simplesamlphp · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12874 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-18122 · Aviso do Fabricante