Improper Verification of Cryptographic Signature in SimpleSAMLphp - CVE-2018-7711
Published: March 5, 2018 / Updated: July 17, 2020
Vulnerability identifier: #VU31345
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2018-7711
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: SimpleSAMLphp
Affected software:
SimpleSAMLphp
SimpleSAMLphp
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true boolean value.
How to mitigate CVE-2018-7711
Install update from vendor's website.