CVE-2024-52806
published 2024-12-02CVE-2024-52806: SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's…
PriorityP342high8.3CVSS 3.1
AVNACLPRNUINSCCLILAL
EPSS
0.41%
33.5th percentile
SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | simplesamlphp | < simplesamlphp 1.19.7-1+deb12u1 (bookworm) | simplesamlphp 1.19.7-1+deb12u1 (bookworm) |
| simplesamlphp | saml2 | < 4.6.14 | 4.6.14 |
| simplesamlphp | saml2 | — | — |
| simplesamlphp | saml2 | >= 0 < 4.6.14 | 4.6.14 |
| simplesamlphp | saml2-legacy | >= 0 < 4.6.14 | 4.6.14 |
| simplesamlphp | simplesamlphp | >= 0 < 1.19.0-1+deb11u1 | 1.19.0-1+deb11u1 |
| simplesamlphp | simplesamlphp | >= 0 < 1.19.7-1+deb12u1 | 1.19.7-1+deb12u1 |
CVSS provenance
nvdv3.18.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
osv8.3HIGH
vendor_debian8.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
osv·2024-12-02
CVE-2024-52806 [MEDIUM] SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
Summary
When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE.
$options is defined as: https://github.com/simplesamlphp/saml2/blob/717c0adc4877ebd58428637e5626345e59fa0109/src/SAML2/DOMDocumentFactory.php#L41
including the DTDLoad option, which allows an attacker to read file contents from local file system OR internal network.
While there is the NONET option, an attacker can simply bypass if by using PHP filters:
php://filter/convert.base64-encode/resource=http://URL OR FILE
From there an attacker can induce network connections and steal the targeted file OOB (haven't fully tested this).
RCE may be possible with the php://expect or php://phar wrappers, but this hasn't been tested
OSV
CVE-2024-52806: SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality
osv·2024-12-02·CVSS 8.3
CVE-2024-52806 [HIGH] CVE-2024-52806: SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality
SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.
GHSA
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
ghsa·2024-12-02
CVE-2024-52806 [MEDIUM] CWE-611 SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
Summary
When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE.
$options is defined as: https://github.com/simplesamlphp/saml2/blob/717c0adc4877ebd58428637e5626345e59fa0109/src/SAML2/DOMDocumentFactory.php#L41
including the DTDLoad option, which allows an attacker to read file contents from local file system OR internal network.
While there is the NONET option, an attacker can simply bypass if by using PHP filters:
php://filter/convert.base64-encode/resource=http://URL OR FILE
From there an attacker can induce network connections and steal the targeted file OOB (haven't fully tested this).
RCE may be possible with the php://expect or php://phar wrappers, but this hasn't been tested
Debian
CVE-2024-52806: simplesamlphp - SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Wh...
vendor_debian·2024·CVSS 8.3
CVE-2024-52806 [HIGH] CVE-2024-52806: simplesamlphp - SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Wh...
SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.
Scope: local
bookworm: resolved (fixed in 1.19.7-1+deb12u1)
bullseye: resolved (fixed in 1.19.0-1+deb11u1)
sid: resolved (fixed in 1.19.7-1+deb12u1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-12-02
Published