Vulnerabilities > CVE-2012-0908 - Cross-site Scripting vulnerability in Simplesamlphp

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(57635);
  script_version("1.10");
  script_cvs_date("Date: 2018/11/15 20:50:20");

  script_cve_id("CVE-2012-0908");
  script_bugtraq_id(51372);

  script_name(english:"SimpleSAMLphp logout.php link_href Parameter XSS");
  script_summary(english:"Tries to inject an XSS payload through link_href parameter");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server hosts a PHP application that contains a
cross-site scripting vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of SimpleSAMLphp on the remote host contains a cross-site
scripting vulnerability because it fails to sanitize input to the
'link_href' parameter of the 'logout.php' script before including it
in a web page.

An attacker can leverage this issue by enticing a user to follow a
malicious URL, causing attacker-specified script code to run inside
the user's browser in the context of the affected site.  Information
harvested this way may aid in launching further attacks.

Versions of SimpleSAMLphp containing this vulnerability may also
contain another cross-site scripting vulnerability in no_cookie.php,
but this script did not test for that.");
  script_set_attribute(attribute:"solution", value:"Upgrade to version 1.8.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
  script_set_attribute(attribute:"see_also", value:"https://code.google.com/archive/p/simplesamlphp/issues/468");
  script_set_attribute(attribute:"see_also", value:"http://code.google.com/p/simplesamlphp/source/detail?r=3009");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/01/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/01/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/01/23");

  script_set_attribute(attribute:"cpe", value:"cpe:/a:simplesamlphp:simplesamlphp");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"CGI abuses : XSS");

  script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");

  script_dependencies("simplesamlphp_detect.nasl");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_keys("www/PHP", "www/simplesamlphp");
  script_require_ports("Services/www", 443);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("http.inc");
include("misc_func.inc");
include("webapp_func.inc");

port = get_http_port(default:80, php:TRUE);

install = get_install_from_kb(appname:"simplesamlphp", port:port, exit_on_fail:TRUE);
dir = install["dir"];

cgi = "/logout.php";
xss = "javascript:alert('XSS');";

exploited = test_cgi_xss(
  port     : port,
  dirs     : make_list(dir),
  cgi      : cgi,
  qs       : "link_href=" + xss,
  pass_str : xss,
  ctrl_re  : 'Copyright *&copy; *[-0-9]+ *<a +href="http://rnd.feide.no/">Feide *RnD</a>'
);

if (!exploited)
  exit(0, "The SimpleSAMLphp install at " + build_url(qs:dir + cgi, port:port) + " is not affected.");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-2387. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(57527);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2012-0040", "CVE-2012-0908");
  script_bugtraq_id(51372);
  script_xref(name:"DSA", value:"2387");

  script_name(english:"Debian DSA-2387-1 : simplesamlphp - insufficient input sanitation");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"'timtai1' discovered that simpleSAMLphp, an authentication and
federation platform, is vulnerable to a cross site scripting attack,
allowing a remote attacker to access sensitive client data.

The oldstable distribution (lenny) does not contain a simplesamlphp
package."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/squeeze/simplesamlphp"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2012/dsa-2387"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the simplesamlphp packages.

For the stable distribution (squeeze), this problem has been fixed in
version 1.6.3-3."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:simplesamlphp");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2012/01/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/01/12");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"6.0", prefix:"simplesamlphp", reference:"1.6.3-3")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");