Vulnerabilities > CVE-2017-12867 - Insufficient Session Expiration vulnerability in Simplesamlphp

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
simplesamlphp
CWE-613
nessus

Summary

The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.

Vulnerable Configurations

Part Description Count
Application
Simplesamlphp
71

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4127.NASL
    descriptionSeveral vulnerabilities have been discovered in SimpleSAMLphp, a framework for authentication, primarily via the SAML protocol. - CVE-2017-12867 Attackers with access to a secret token could extend its validity period by manipulating the prepended time offset. - CVE-2017-12869 When using the multiauth module, attackers can bypass authentication context restrictions and use any authentication source defined in the config. - CVE-2017-12873 Defensive measures have been taken to prevent the administrator from misconfiguring persistent NameIDs to avoid identifier clash. (Affects Debian 8 Jessie only.) - CVE-2017-12874 The InfoCard module could accept incorrectly signed XML messages in rare occasions. - CVE-2017-18121 The consentAdmin module was vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code in the victim
    last seen2020-06-01
    modified2020-06-02
    plugin id107119
    published2018-03-05
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/107119
    titleDebian DSA-4127-1 : simplesamlphp - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-4127. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(107119);
      script_version("3.3");
      script_cvs_date("Date: 2018/11/13 12:30:46");
    
      script_cve_id("CVE-2017-12867", "CVE-2017-12869", "CVE-2017-12873", "CVE-2017-12874", "CVE-2017-18121", "CVE-2017-18122", "CVE-2018-6519", "CVE-2018-6521", "CVE-2018-7644");
      script_xref(name:"DSA", value:"4127");
    
      script_name(english:"Debian DSA-4127-1 : simplesamlphp - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities have been discovered in SimpleSAMLphp, a
    framework for authentication, primarily via the SAML protocol.
    
      - CVE-2017-12867
        Attackers with access to a secret token could extend its
        validity period by manipulating the prepended time
        offset.
    
      - CVE-2017-12869
        When using the multiauth module, attackers can bypass
        authentication context restrictions and use any
        authentication source defined in the config.
    
      - CVE-2017-12873
        Defensive measures have been taken to prevent the
        administrator from misconfiguring persistent NameIDs to
        avoid identifier clash. (Affects Debian 8 Jessie only.)
    
      - CVE-2017-12874
        The InfoCard module could accept incorrectly signed XML
        messages in rare occasions.
    
      - CVE-2017-18121
        The consentAdmin module was vulnerable to a Cross-Site
        Scripting attack, allowing an attacker to craft links
        that could execute arbitrary JavaScript code in the
        victim's browser.
    
      - CVE-2017-18122
        The (deprecated) SAML 1.1 implementation would regard as
        valid any unsigned SAML response containing more than
        one signed assertion, provided that the signature of at
        least one of the assertions was valid, allowing an
        attacker that could obtain a valid signed assertion from
        an IdP to impersonate users from that IdP.
    
      - CVE-2018-6519
        Regular expression denial of service when parsing
        extraordinarily long timestamps.
    
      - CVE-2018-6521
        Change sqlauth module MySQL charset from utf8 to utf8mb
        to prevent theoretical query truncation that could allow
        remote attackers to bypass intended access restrictions
    
      - CVE-2018-7644
        Critical signature validation vulnerability."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889286"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-12867"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-12869"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-12873"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-12874"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-18121"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-18122"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2018-6519"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2018-6521"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2018-7644"
      );
      # https://security-tracker.debian.org/tracker/source-package/simplesamlphp
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?b2a51c10"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/simplesamlphp"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/stretch/simplesamlphp"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2018/dsa-4127"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the simplesamlphp packages.
    
    For the oldstable distribution (jessie), these problems have been
    fixed in version 1.13.1-2+deb8u1.
    
    For the stable distribution (stretch), these problems have been fixed
    in version 1.14.11-1+deb9u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:simplesamlphp");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2018/03/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/05");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"simplesamlphp", reference:"1.13.1-2+deb8u1")) flag++;
    if (deb_check(release:"9.0", prefix:"simplesamlphp", reference:"1.14.11-1+deb9u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1205.NASL
    descriptionThe simplesamlphp package in wheezy is vulnerable to multiple attacks on authentication-related code, leading to unauthorized access and information disclosure. CVE-2017-12867 The SimpleSAML_Auth_TimeLimitedToken class allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset. CVE-2017-12869 The multiauth module allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input. CVE-2017-12872 / CVE-2017-12868 The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote iattackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input. CVE-2017-12868 was a about an improper fix of CVE-2017-12872 in the initial patch released by upstream. We have used the correct patch. CVE-2017-12873 SimpleSAMLphp might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured. CVE-2017-12874 The InfoCard module for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities. For Debian 7
    last seen2020-03-17
    modified2017-12-13
    plugin id105193
    published2017-12-13
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/105193
    titleDebian DLA-1205-1 : simplesamlphp security update
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-1205-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(105193);
      script_version("3.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2017-12867", "CVE-2017-12868", "CVE-2017-12869", "CVE-2017-12872", "CVE-2017-12873", "CVE-2017-12874");
    
      script_name(english:"Debian DLA-1205-1 : simplesamlphp security update");
      script_summary(english:"Checks dpkg output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The simplesamlphp package in wheezy is vulnerable to multiple attacks
    on authentication-related code, leading to unauthorized access and
    information disclosure.
    
    CVE-2017-12867
    
    The SimpleSAML_Auth_TimeLimitedToken class allows attackers with
    access to a secret token to extend its validity period by manipulating
    the prepended time offset.
    
    CVE-2017-12869
    
    The multiauth module allows remote attackers to bypass authentication
    context restrictions and use an authentication source defined in
    config/authsources.php via vectors related to improper validation of
    user input.
    
    CVE-2017-12872 / CVE-2017-12868
    
    The (1) Htpasswd authentication source in the authcrypt module and (2)
    SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow
    remote iattackers to conduct timing side-channel attacks by leveraging
    use of the standard comparison operator to compare secret material
    against user input.
    
    CVE-2017-12868 was a about an improper fix of CVE-2017-12872
    in the initial patch released by upstream. We have used the
    correct patch.
    
    CVE-2017-12873
    
    SimpleSAMLphp might allow attackers to obtain sensitive information,
    gain unauthorized access, or have unspecified other impacts by
    leveraging incorrect persistent NameID generation when an Identity
    Provider (IdP) is misconfigured.
    
    CVE-2017-12874
    
    The InfoCard module for SimpleSAMLphp allows attackers to spoof XML
    messages by leveraging an incorrect check of return values in
    signature validation utilities.
    
    For Debian 7 'Wheezy', these problems have been fixed in version
    1.9.2-1+deb7u1.
    
    We recommend that you upgrade your simplesamlphp packages.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/wheezy/simplesamlphp"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Upgrade the affected simplesamlphp package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:simplesamlphp");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2017/12/12");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/12/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2020 Tenable Network Security, Inc.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"7.0", prefix:"simplesamlphp", reference:"1.9.2-1+deb7u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");