CVE-2020-5301 (Low) detected in simplesamlphp/simplesamlphp-v1.17.8

[mend-bolt-for-github]

CVE-2020-5301 - Low Severity Vulnerability

Vulnerable Library - simplesamlphp/simplesamlphp-v1.17.8

A PHP implementation of a SAML 2.0 service provider and identity provider, also compatible with Shibboleth 1.3 and 2.0.

Library home page: https://api.github.com/repos/simplesamlphp/simplesamlphp/zipball/295937ae8672278cad73ec2c78af3749426263de

Dependency Hierarchy:

• simplesamlphp/composer-module-installer-v1.1.6 (Root Library)
  • ❌ simplesamlphp/simplesamlphp-v1.17.8 (Vulnerable Library)

Found in HEAD commit: fd17359125e6714801096e1c3ae3b23131de8463

Vulnerability Details

SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in SimpleSAML\Module that processes requests for pages hosted by modules, has code to identify paths ending with .php and process those as PHP code. If no other suitable way of handling the given path exists it presents the file to the browser. The check to identify paths ending with .php does not account for uppercase letters. If someone requests a path ending with e.g. .PHP and the server is serving the code from a case-insensitive file system, such as on Windows, the processing of the PHP code does not occur, and the source code is instead presented to the browser. An attacker may use this issue to gain access to the source code in third-party modules that is meant to be private, or even sensitive. However, the attack surface is considered small, as the attack will only work when SimpleSAMLphp serves such content from a file system that is not case-sensitive, such as on Windows. This issue is fixed in version 1.18.6.

Publish Date: 2020-04-21

URL: CVE-2020-5301

CVSS 3 Score Details (3.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-24m3-w8g9-jwpq

Release Date: 2020-04-21

Fix Resolution: 1.18.6

---

Step up your Open Source Security Game with Mend here