Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ GHSA-v858-922f-fj9v — simplesamlphp

⚪ Unknown ✅ No Known Exploit CWE-74 OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

SimpleSAMLphp Link Injection vulnerability

Background

Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out.

Description

The following scripts were not checking the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on:

  • www/logout.php
  • modules/core/www/no_cookie.php

The issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack of security checks involving the link_href and retryURL HTTP parameters, respectively. The issue was resolved by including a verification of the URLs received in the request against a white list of websites specified in the trusted.url.domains configuration option.

Affected versions

All SimpleSAMLphp versions prior to 1.14.4.

Impact

A remote attacker could craft a link pointing to a trusted website running SimpleSAMLphp, including a parameter pointing to a malicious website, and try to fool the victim into visiting that website by clicking on a link in the page presented by SimpleSAMLphp.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality low, integrity low, availability none.

Weakness class

GHSA-v858-922f-fj9v is classified as CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or…

Affected software

GHSA-v858-922f-fj9v is recorded against 1 package.

  • simplesamlphp/simplesamlphp (fixed in 1.14.4)

Timeline and source

Published on 28 May 2024 and last revised on 3 December 2024. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Web)
github.com (Web)
github.com (Package)
simplesamlphp.org (Web)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE CWE-74
Public Exploit ✅ No
Source OSV
Published 2024-05-28
Updated 2026-08-20
Modified 2024-12-03
Fix URL N/A

Affected Packages

Software From version Fixed in
simplesamlphp/simplesamlphp — 1.14.4

Free Vulnerability Check

Is your site affected by GHSA-v858-922f-fj9v?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against GHSA-v858-922f-fj9v and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.