GHSA-v858-922f-fj9v

GHSA-v858-922f-fj9v · SimpleSAMLphp Link Injection vulnerability

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

### Background Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out. ### Description The following scripts were not checking the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on: - www/logout.php - modules/core/www/no_cookie.php The issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack of security checks involving the link_href and retryURL HTTP parameters, respectively. The issue was resolved by including a verification of the URLs received in the request against a white list of websites specified in the trusted.url.domains configuration option. ### Affected versions All SimpleSAMLphp versions prior to 1.14.4. ### Impact A remote attacker could craft a link pointing to a trusted website running SimpleSAMLphp, including a parameter pointing to a malicious website, and try to fool the victim into visiting that website by clicking on a link in the page presented by SimpleSAMLphp.

CVSS 5.4 · Moyenne · Correctif disponible

Publication

2024-05-28T18:26:35Z

Mise à jour

2024-12-03T06:07:22.402856Z

Pile logicielle: php

Vérifiez votre serveur →