Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS05d3J3LXA5cm0tcjc4Ms4AA8Rx

onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.

In order to verify Signatures on Logoutrequests and LogoutResponses we use
the verifySignature of the class XMLSecurityKey from the xmlseclibs library.
That method end up calling openssl_verify() depending on the signature algorithm used.

The openssl_verify() function returns 1 when the signature was successfully verified,
0 if it failed to verify with the given key, and -1 in case an error occurs.
PHP allows translating numerical values to boolean implicitly, with the following correspondences:

• 0 equals false.
• Non-zero equals true.

This means that an implicit conversion to boolean of the values returned by openssl_verify()
will convert an error state, signaled by the value -1, to a successful verification of the
signature (represented by the boolean true).

The LogoutRequest/LogoutResponse signature validator was performing an implicit conversion to boolean
of the values returned by the verify() method, which subsequently will return the same output
as openssl_verify() under most circumstances.
This means an error during signature verification is treated as a successful verification by the method.

Since the signature validation of SAMLResponses were not affected, the impact of this security
vulnerability is lower, but an update of the php-saml toolkit is recommended.

Permalink: https://github.com/advisories/GHSA-9wrw-p9rm-r782
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05d3J3LXA5cm0tcjc4Ms4AA8Rx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: 4 months ago
Updated: 4 months ago

Identifiers: GHSA-9wrw-p9rm-r782
References:

• https://github.com/onelogin/php-saml/commit/949359f5cad5e1d085c4e5447d9aa8f49a6e82a1
• https://github.com/FriendsOfPHP/security-advisories/blob/master/onelogin/php-saml/2017-02-28.yaml
• https://github.com/advisories/GHSA-9wrw-p9rm-r782

Repository: https://github.com/onelogin/php-saml
Blast Radius: 0.0

Affected Packages