Skip to content

Commit 1398ca1

Browse files
tvdijentvdijen
committed
deploy: e1e9a83 
1 parent 318c18f commit 1398ca1

File tree

3 files changed

+123
-2
lines changed

3 files changed

+123
-2
lines changed

‎feed.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
<description>SimpleSAMLphp** is an award-winning application written in native PHP that deals with authentication. It implements support for multiple protocols, most notably SAML, OpenID or OAuth.</description>
66
<link>https://simplesamlphp.org/</link>
77
<atom:link href="https://simplesamlphp.org/feed.xml" rel="self" type="application/rss+xml"/>
8-
<pubDate>Tue, 11 Mar 2025 18:13:13 +0000</pubDate>
9-
<lastBuildDate>Tue, 11 Mar 2025 18:13:13 +0000</lastBuildDate>
8+
<pubDate>Tue, 11 Mar 2025 18:24:33 +0000</pubDate>
9+
<lastBuildDate>Tue, 11 Mar 2025 18:24:33 +0000</lastBuildDate>
1010
<generator>Jekyll v4.2.1</generator>
1111

1212
<item>

‎security/202501-01.html‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta http-equiv="content-type" content="text/html; charset=utf-8">
5+
<meta name="google-site-verification" content="2S8M18BgYs8cLRL6ClTrfW_xGxfFtMZu2b2jhjrNlss">
6+
7+
<meta http-equiv="X-UA-Compatible" content="IE=edge">
8+
<meta name="viewport" content="width=device-width, initial-scale=1">
9+
10+
<title>SSPSA 202501-01: Signature bypass vulnerability - SimpleSAMLphp</title>
11+
<meta name="description" content="SimpleSAMLphp** is an award-winning application written in native PHP that deals with authentication. It implements support for multiple protocols, most notably SAML, OpenID or OAuth.">
12+
13+
<link rel="stylesheet" href="/res/css/style.css">
14+
<link rel="stylesheet" href="/res/css/layout.css">
15+
<link rel="canonical" href="https://simplesamlphp.org/security/202501-01.html">
16+
<link rel="alternate" type="application/rss+xml" title="SimpleSAMLphp" href="https://simplesamlphp.org/feed.xml">
17+
</head>
18+
19+
<body>
20+
<!-- Red logo header -->
21+
<header>
22+
<div id="header">
23+
<div class="right">
24+
<form class="searchbox" method="get" action="https://www.google.com/cse">
25+
<input type="hidden" name="cx" value="004202914224971217557:8ks4jjstupq">
26+
<input type="hidden" name="siteurl" value="www.google.com/cse/home?cx=004202914224971217557:8ks4jjstupq">
27+
<input type="hidden" name="adkw" value="AELymgVJ6Sk-kOvUjbxvgShTLwiFlma2evFuVCh0r8q23vn_4eVnkcdnPfbgMvYUTpJpVlb-KkGAKkbn0i-AlWHsVRR9O0J4CNb6cXFkEKRdjXxsC_NlVD4">
28+
<input type="search" name="q" placeholder="Search" value="">
29+
</form>
30+
</div>
31+
<div class="v-center logo-header">
32+
<div id="logo">
33+
<a href="https://simplesamlphp.org">
34+
<span class="simple">Simple</span>
35+
<span class="saml">SAML</span>
36+
<span class="simple">php</span>
37+
</a>
38+
</div>
39+
</div>
40+
41+
</div>
42+
43+
<!-- Grey header bar below -->
44+
<nav>
45+
<div id="headerbar">
46+
<p id="breadcrumb"><a href="https://simplesamlphp.org">Home</a> » SSPSA 202501-01: Signature bypass vulnerability</p>
47+
<div class="mtoolbar">
48+
<div class="menuitem first">
49+
<a href="/download">Download</a>
50+
</div>
51+
<div class="menuitem">
52+
<a href="/docs">Documentation</a>
53+
</div>
54+
<div class="menuitem">
55+
<a href="/security">Security</a>
56+
</div>
57+
<div class="menuitem">
58+
<a href="/modules/">Modules</a>
59+
</div>
60+
<div class="menuitem">
61+
<a href="/support/">Support</a>
62+
</div>
63+
<div class="menuitem last">
64+
<a href="/contrib/">Contribute</a>
65+
</div>
66+
</div>
67+
<br style="clear: both; height: 0px; width: 0px">
68+
<br style="height: 0px; clear: both">
69+
</div><!-- /#headerbar -->
70+
</nav>
71+
</header>
72+
73+
<main>
74+
75+
<aside><div class="sidebar-warning right">
76+
<h2>Date</h2>
77+
11 March 2025
78+
<h2>Affected versions</h2>
79+
80+
<code>SimpleSAMLphp 2.3.0 - 2.3.6</code><br />
81+
<code>SimpleSAMLphp 2.2.0 - 2.2.4</code><br />
82+
83+
<code>Any older version</code><br />
84+
<h2>Severity</h2>
85+
High - CVE 8.6
86+
</div></aside>
87+
88+
<h1 id="202501-01">202501-01</h1>
89+
90+
<p><strong>Signature bypass vulnerability</strong></p>
91+
92+
<h3 id="description">Description</h3>
93+
94+
<p>When passing multiple SAMLResponse-parameters, the signature would be validated on the second one instead of the first one.</p>
95+
96+
<h3 id="mitigation">Mitigation:</h3>
97+
98+
<p>Update to the latest version of SimpleSAMLphp, or manually bump the <code class="language-plaintext highlighter-rouge">simplesamlphp/saml2</code> dependency to v4.17.0</p>
99+
100+
<h3 id="background--details">Background / details</h3>
101+
102+
<p>The HTTPRedirect-binding didn’t properly check the query-parameters.
103+
We’ve changed it to check for duplicate parameters and any illegal combination of parameters (i.e. both a SAMLResponse and a SAMLRequest).</p>
104+
105+
<h3 id="credit">Credit</h3>
106+
107+
<p>This vulnerability was discovered and reported by ahacker1-securesaml on November 18, 2024.
108+
It is registered under CVE-2025-27773.</p>
109+
110+
</main>
111+
112+
<footer>
113+
<img class="logo" src="/res/ssplogo-fish-2.svg" alt="">
114+
</footer>
115+
116+
</body>
117+
</html>

‎sitemap.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,10 @@
133133
<loc>https://simplesamlphp.org/security/202412-01.html</loc>
134134
</url>
135135

136+
<url>
137+
<loc>https://simplesamlphp.org/security/202501-01.html</loc>
138+
</url>
139+
136140
<url>
137141
<loc>https://simplesamlphp.org/404.html</loc>
138142
</url>

0 commit comments

Comments
 (0)