SimpleSAMLphp up to 1.18.5 Request Source information disclosure

Summaryinfo

A vulnerability has been found in SimpleSAMLphp up to 1.18.5 and classified as problematic. The affected element is an unknown function. This manipulation as part of Request causes information disclosure (Source). This vulnerability is handled as CVE-2020-5301. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in SimpleSAMLphp up to 1.18.5. Affected by this vulnerability is an unknown part. The manipulation as part of a Request leads to a information disclosure vulnerability (Source). The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:

SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in `SimpleSAML\Module` that processes requests for pages hosted by modules, has code to identify paths ending with `.php` and process those as PHP code. If no other suitable way of handling the given path exists it presents the file to the browser. The check to identify paths ending with `.php` does not account for uppercase letters. If someone requests a path ending with e.g. `.PHP` and the server is serving the code from a case-insensitive file system, such as on Windows, the processing of the PHP code does not occur, and the source code is instead presented to the browser. An attacker may use this issue to gain access to the source code in third-party modules that is meant to be private, or even sensitive. However, the attack surface is considered small, as the attack will only work when SimpleSAMLphp serves such content from a file system that is not case-sensitive, such as on Windows. This issue is fixed in version 1.18.6.

The weakness was released 04/21/2020 (GitHub Repository). It is possible to read the advisory at github.com. This vulnerability is known as CVE-2020-5301 since 01/02/2020. The exploitation appears to be difficult. The attack can be launched remotely. A single authentication is necessary for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 1.18.6 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• SimpleSAMLphp

Version

• 1.18.0
• 1.18.1
• 1.18.2
• 1.18.3
• 1.18.4
• 1.18.5

License

• open-source

Website

• Product: https://github.com/simplesamlphp/simplesamlphp/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion