PT-2024-35456 · Unknown · Simplesamlphp Saml2 Library

Ahacker1-Securesaml · Published 2024-12-02 · Updated 2024-12-03 · CVE-2024-52806

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp SAML2 library versions prior to 4.6.14 SimpleSAMLphp SAML2 library versions prior to 5.0.0-alpha.18

Description The SimpleSAMLphp SAML2 library is vulnerable to an XML External Entity (XXE) attack when loading untrusted XML documents, such as the SAMLResponse. This allows an attacker to induce an XXE, potentially leading to the reading of file contents from the local file system or internal network. The LIBXML DTDLOAD option in the $options variable, defined in the DOMDocumentFactory.php file, enables this vulnerability. An attacker can bypass the NONET option by using PHP filters, such as php://filter/convert.base64-encode/resource=http://URL or php://filter/convert.base64-encode/resource=FILE, to induce network connections and steal targeted files. Remote Code Execution (RCE) may also be possible using the php://expect or php://phar wrappers, although this has not been fully tested.

Recommendations For SimpleSAMLphp SAML2 library versions prior to 4.6.14, update to version 4.6.14 or later. For SimpleSAMLphp SAML2 library versions prior to 5.0.0-alpha.18, update to version 5.0.0-alpha.18 or later. As a temporary mitigation measure, consider removing the LIBXML DTDLOAD | LIBXML DTDATTR options from the $options variable. Additionally, check for the presence of the string <!DOCTYPE inside the XML before parsing it, although this is not a complete fix.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-52806

DLA-3981-1

DSA-5822-1

GHSA-PXM4-R5PH-Q2M2

Affected Products

Simplesamlphp Saml2 Library

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52806.json · Exploit
• https://osv.dev/vulnerability/GHSA-pxm4-r5ph-q2m2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-52806 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52806 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5822-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52806 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-52806 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3981-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-52806 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-52806 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-52806 · Vendor Advisory
• https://github.com/simplesamlphp/saml2/security/advisories/GHSA-pxm4-r5ph-q2m2 · Note
• https://github.com/simplesamlphp/saml2/commit/5fd4ce4596656fb0c1278f15b8305825412e89f7 · Note
• https://github.com/simplesamlphp/saml2 · Note
• https://twitter.com/CVEnew/status/1863649274178965883 · Twitter Post