Bugtraq: SimpleSAMLphp Link Injection

[+] Credits: John Page aka hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source: http://ift.tt/1VPPlG8

.txt

[+] ISR: apparitionsec

Vendor:

=================

simplesamlphp.org

Product:

======================

simplesamlphp < 1.14.4

Vulnerability Type:

===================

Link Injection

CVE Reference:

==============

N/A

Vulnerability Details:

=====================

Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This is supposed to enhance

usability, as the users are presented with links they can follow after completing a certain action, like logging out.

The following scripts do not check the URLs obtained via the HTTP request before displaying them as the target of links that the user

may click on:

www/logout.php

modules/core/www/no_cookie.php

The issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack

of security checks involving the link_href and retryURL HTTP parameters, respectively. The issue was resolved by including a verification

of the URLs received in the request against a white list of websites specified in the trusted.url.domains configuration option.

References:

http://ift.tt/24ExTou

Affected versions:

All SimpleSAMLphp versions prior to 1.14.4.

Impact:

A remote attacker could craft a link or pop up webpage pointing to a trusted website running SimpleSAMLphp, including a parameter pointing

to a malicious website, to fool the victim into visiting that website by clicking on a link in the page presented by the "trusted" SimpleSAMLphp

application.

Vulnerable Codes:

"no_cookie.php" ...

======================

if (isset($_REQUEST['retryURL'])) {

$retryURL = (string)$_REQUEST['retryURL'];

$retryURL = \SimpleSAML\Utils\HTTP::normalizeURL($retryURL);

} else {

$retryURL = NULL;

}

$globalConfig = SimpleSAML_Configuration::getInstance();

$t = new SimpleSAML_XHTML_Template($globalConfig, 'core:no_cookie.tpl.php');

$t->data['retryURL'] = $retryURL;

$t->show();

"logout.php" ...

====================

if (array_key_exists('link_href', $_REQUEST)) {

$link = (string) $_REQUEST['link_href'];

$link = \SimpleSAML\Utils\HTTP::normalizeURL($link);

} else {

$link = 'index.php';

}

if (array_key_exists('link_text', $_REQUEST)) {

$text = $_REQUEST['link_text'];

} else {

$text = '{logout:default_link_text}';

}

$t = new SimpleSAML_XHTML_Template($config, 'logout.php');

$t->data['link'] = $link;

$t->data['text'] = $text;

$t->show();

Exploit code(s):

===============

1) https://victim-server/simplesaml/module.php/core/no_cookie.php?retryURL=

https://attacker-server

2) https://victim-server/simplesaml/logout.php?link_href=http://attacker-se

rver/Evil.php&link_text=PLEASE%20DOWNLOAD%20THIS%20IMPORTANT%20UPDATE

Disclosure Timeline:

===================================

Vendor Notification: May 31, 2016

June 9, 2016 : Public Disclosure

Exploitation Technique:

=======================

Remote

Severity Level:

================

Low

[+] Disclaimer

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.

Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and

that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit

is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility

for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information

or exploits by the author or elsewhere.

hyp3rlinx

[ reply ]

from SecurityFocus Vulnerabilities http://ift.tt/24ExOkE