{"id":"GHSA-2r3v-q9x3-7g46","aliases":[],"title":"Link injection in SimpleSAMLphp","description":"### Background\nSeveral scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out.\n\n### Description\nThe following scripts were not checking the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on:\n\n- `www/logout.php`\n- `modules/core/www/no_cookie.php`\n\nThe issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack of security checks involving the `link_href` and `retryURL` HTTP parameters, respectively. The issue was resolved by including a verification of the URLs received in the request against a white list of websites specified in the `trusted.url.domains` configuration option.\n\n### Affected versions\nAll SimpleSAMLphp versions prior to 1.14.4.\n\n### Impact\nA remote attacker could craft a link pointing to a trusted website running SimpleSAMLphp, including a parameter pointing to a malicious website, and try to fool the victim into visiting that website by clicking on a link in the page presented by SimpleSAMLphp.\n\n### Resolution\nUpgrade to the latest version.\n\n### Credit\nThis security issue was discovered and reported by John Page (hyp3rlinx).","severity":"low","score":3.7,"published":"2020-01-24T21:27:16.000Z","modified":"2024-12-01T05:38:18.893Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"simplesamlphp/simplesamlphp","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.14.4"}],"type":"ECOSYSTEM"}],"versions":["v1.12.0","v1.13.0","v1.13.0-rc1","v1.13.0-rc2","v1.13.1","v1.13.2","v1.14.0","v1.14.0-rc1","v1.14.1","v1.14.2","v1.14.3"],"fixed":["1.14.4"]}],"references":["https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-2r3v-q9x3-7g46","https://snyk.io/vuln/SNYK-PHP-SIMPLESAMLPHPSIMPLESAMLPHP-70160"],"sources":[{"name":"OSV","id":"GHSA-2r3v-q9x3-7g46","modified":"2024-12-01T05:38:18.893389Z","url":"https://osv.dev/vulnerability/GHSA-2r3v-q9x3-7g46"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7}]}