SimpleSAMLphp up to 1.18.3 Log www/erroreport.php reportID log file

Summaryinfo

A vulnerability has been found in SimpleSAMLphp up to 1.18.3 and classified as critical. This affects an unknown part of the file www/erroreport.php of the component Log Handler. The manipulation of the argument reportID as part of Parameter leads to log file. This vulnerability is uniquely identified as CVE-2020-5225. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in SimpleSAMLphp up to 1.18.3. It has been rated as critical. This issue affects an unknown part of the file www/erroreport.php of the component Log Handler. The manipulation of the argument reportID as part of a Parameter leads to a log file vulnerability. Using CWE to declare the problem leads to CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID. When configured to use the file logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the reportID parameter received in a request sent to www/errorreport.php was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.

The weakness was disclosed 01/24/2020 (GitHub Repository). It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2020-5225 since 01/02/2020. The exploitation is known to be difficult. The attack may be initiated remotely. A simple authentication is necessary for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

By approaching the search of inurl:www/erroreport.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.18.4 eliminates this vulnerability.

The entry VDB-149328 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• SimpleSAMLphp

Version

• 1.18.0
• 1.18.1
• 1.18.2
• 1.18.3

License

• open-source

Website

• Product: https://github.com/simplesamlphp/simplesamlphp/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion