NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

SimpleSAMLphp Link Injection vulnerabilityGHSA-v858-922f-fj9v

MEDIUMFix: simplesamlphp/simplesamlphp@b1af4e4

GHSA-v858-922f-fj9v is a medium-severity (CVSS 5.4) vulnerability in simplesamlphp/simplesamlphp. A fix is available for simplesamlphp/simplesamlphp — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Dec 3, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐘simplesamlphp/simplesamlphp

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Background

Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out.

Description

The following scripts were not checking the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on:

  • www/logout.php
  • modules/core/www/no_cookie.php The issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack of security checks involving the link_href and retryURL HTTP parameters, respectively. The issue was resolved by including a verification of the URLs received in the request against a white list of websites specified in the trusted.url.domains configuration option.

Affected versions

All SimpleSAMLphp versions prior to 1.14.4.

Impact

A remote attacker could craft a link pointing to a trusted website running SimpleSAMLphp, including a parameter pointing to a malicious website, and try to fool the victim into visiting that website by clicking on a link in the page presented by SimpleSAMLphp.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistsimplesamlphp/simplesamlphpall versions1.14.4composer require simplesamlphp/simplesamlphp:^1.14.4

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for simplesamlphp/simplesamlphp, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update simplesamlphp/simplesamlphp to 1.14.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-v858-922f-fj9v is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Background Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out. ### Description The following scripts were not checking the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on: - www/logout.php - modules/core/www/no_cookie.php The issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAM
O3 Security · Impact-Aware SCA

Is GHSA-v858-922f-fj9v in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
SimpleSAMLphp Link Injection vulnerability (Medium 5.4)