PT-2024-35392 · Unknown · Simplesamlphp

Ahacker1-Securesaml · Published 2024-12-02 · Updated 2024-12-02 · CVE-2024-52596

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp xml-common versions prior to 1.19.0

Description The issue arises when loading an untrusted XML document, such as the SAMLResponse, allowing an attacker to induce an XML External Entity (XXE) attack. This could potentially enable an attacker to read file contents from the local file system or internal network. Although there are options like NONET, an attacker can bypass them using PHP filters. The vulnerability may also lead to remote code execution (RCE) using certain PHP wrappers, but this has not been fully tested.

Recommendations For versions prior to 1.19.0, remove the LIBXML DTDLOAD | LIBXML DTDATTR options from $options to mitigate the issue. Additionally, as a defense-in-depth measure, check for the string <!DOCTYPE inside the XML before parsing it. However, note that this is not a complete fix, as there might be parser differentials that could load a DOCTYPE. Upgrade to version 1.19.0 or later to secure the handling of XML structures.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-52596

DLA-3981-1

DSA-5822-1

GHSA-2X65-FPCH-2FCM

GHSA-J5G2-Q29X-CW3H

Affected Products

Simplesamlphp

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52596.json · Exploit
• https://osv.dev/vulnerability/GHSA-2x65-fpch-2fcm · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-52596 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-52596 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-52596 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52596 · Security Note
• https://osv.dev/vulnerability/DSA-5822-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j5g2-q29x-cw3h · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-52596 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3981-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52596 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-52596 · Security Note
• https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-j5g2-q29x-cw3h · Note
• https://github.com/simplesamlphp/simplesamlphp/releases/tag/v2.3.4 · Note
• https://github.com/simplesamlphp/simplesamlphp · Note