phpCAS up to 1.5.x phpCAS::setUrl resource injection

Summaryinfo

A vulnerability was found in phpCAS up to 1.5.x. It has been classified as problematic. This affects the function phpCAS::setUrl. This manipulation causes resource injection. This vulnerability is registered as CVE-2022-39369. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in phpCAS up to 1.5.x and classified as problematic. Affected by this vulnerability is the function phpCAS::setUrl. The manipulation with an unknown input leads to a resource injection vulnerability. The CWE definition for the vulnerability is CWE-99. The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a valid ticket granted for any authorized service in the same SSO realm (CAS server) to authenticate to the service protected by phpCAS. Depending on the settings of the CAS server service registry in worst case this may be any other service URL (if the allowed URLs are configured to "^(https)://.*") or may be strictly limited to known and authorized services in the same SSO federation if proper URL service validation is applied. This vulnerability may allow an attacker to gain access to a victim's account on a vulnerable CASified service without victim's knowledge, when the victim visits attacker's website while being logged in to the same CAS server. phpCAS 1.6.0 is a major version upgrade that starts enforcing service URL discovery validation, because there is unfortunately no 100% safe default config to use in PHP. Starting this version, it is required to pass in an additional service base URL argument when constructing the client class. For more information, please refer to the upgrading doc. This vulnerability only impacts the CAS client that the phpCAS library protects against. The problematic service URL discovery behavior in phpCAS < 1.6.0 will only be disabled, and thus you are not impacted from it, if the phpCAS configuration has the following setup: 1. `phpCAS::setUrl()` is called (a reminder that you have to pass in the full URL of the current page, rather than your service base URL), and 2. `phpCAS::setCallbackURL()` is called, only when the proxy mode is enabled. 3. If your PHP's HTTP header input `X-Forwarded-Host`, `X-Forwarded-Server`, `Host`, `X-Forwarded-Proto`, `X-Forwarded-Protocol` is sanitized before reaching PHP (by a reverse proxy, for example), you will not be impacted by this vulnerability either. If your CAS server service registry is configured to only allow known and trusted service URLs the severity of the vulnerability is reduced substantially in its severity since an attacker must be in control of another authorized service. Otherwise, you should upgrade the library to get the safe service discovery behavior.

The weakness was published 11/01/2022 as GHSA-8q72-6qq8-xv64. The advisory is shared at github.com. This vulnerability is known as CVE-2022-39369 since 09/02/2022. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 211181 (Fedora 37 : php-pear-CAS (2022-d6c6782130)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.6.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (211181). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• phpCAS

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion