PT-2017-12743 · Simplesamlphp · Simplesamlphp

Jaimeperez · Published 2017-09-01 · Updated 2020-01-24 · CVE-2017-12873

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions 1.7.0 through 1.14.10

Description The issue arises when a SimpleSAMLphp Identity Provider is misconfigured, leading to incorrect persistent NameID generation. This can cause different users to receive the same identifier, potentially allowing attackers to obtain sensitive information or gain unauthorized access. The problem occurs when the SimpleSAML Auth ProcessingChain class attempts to keep a unique user identifier in the state array, but fails due to missing or empty attributes. As a result, all users connecting to a given service provider may receive the same NameID, which can be used to identify users across sessions. Some service providers have already observed cases where this issue has led to security problems.

Recommendations Upgrade to the latest version. Configure a saml:PersistentNameID authentication processing filter according to your needs, ensuring the attribute used as the source for the NameID is present, unique per user, and does not change over time.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2017-12873

DLA-1205-1

DSA-4127-1

GHSA-GP2M-7CFP-H6GF

Affected Products

Simplesamlphp

References · 29

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2017-12873.yaml · Exploit
• https://github.com/simplesamlphp/simplesamlphp/commit/90dca835158495b173808273e7df127303b8b953 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12873 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18121 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12867 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12873 · Security Note
• https://osv.dev/vulnerability/DSA-4127-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7644 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6521 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-12873 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12874 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12873 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12869 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18122 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12873 · Vendor Advisory