CVE-2020-5301: Simplesamlphp/simplesamlphp Remote Code Execution Vulnerability

LOW
Advisory Identifier: GHSA-24m3-w8g9-jwpq
Share
CVSS 3.0
CWE-200 CWE-178
Published
Advisory Summary

CVE-2020-5301 is a LOW (CVSS 3.0) remote code execution vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting Simplesamlphp/simplesamlphp libraries in the Packagist ecosystem. The issue involves information disclosure of source code in simplesamlphp. Remediation is available by upgrading affected packages to version 1.18.6.

CVE-2020-5301 at a Glance

CVE Identifier CVE-2020-5301
GHSA Identifier GHSA-24m3-w8g9-jwpq
Severity LOW
CVSS v3.1 Base Score 3.0
CWE Classification CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected Product Simplesamlphp/simplesamlphp
Package Ecosystem Packagist
Published Date
Last Updated

Security Impact

CVSS: 3.0

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required Low (PR:L)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality Low (C:L)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2020-5301

To remediate this vulnerability, upgrade all affected Simplesamlphp/simplesamlphp dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

simplesamlphp/simplesamlphp fixed: 1.18.6 
Upgrade simplesamlphp/simplesamlphp to 1.18.6
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for simplesamlphp/simplesamlphp

How to Check if You Are Affected

To determine whether your application is affected by CVE-2020-5301, inspect your project dependencies for Simplesamlphp/simplesamlphp:

inspect dependencies for simplesamlphp/simplesamlphp

Analyze the terminal output to locate any version of Simplesamlphp/simplesamlphp in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.18.6), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In Simplesamlphp/simplesamlphp, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Background The module controller in `SimpleSAML\Module` that processes requests for pages hosted by modules, has code to identify paths ending with `.php` and process those as PHP code. If no other suitable way of handling the given path exists it presents the file to the browser. ### Description The check to identify paths ending with `.php` does not account for uppercase letters. If someone requests a path ending with e.g. `.PHP` and the server is serving the code from a case-insensitive file system, such as on Windows, the processing of the PHP code does not occur, and the source code is instead presented to the browser. ### Affected versions SimpleSAMLphp versions **1.18.5 and older**. ### Impact An attacker may use this issue to gain access to the source code in third-party modules that is meant to be private, or even sensitive. However, the attack surface is considered small, as the attack will only work when SimpleSAMLphp serves such content from a file system that is not case-sensitive, such as on Windows. ### Resolution Upgrade the SimpleSAMLphp installation to version **1.18.6**. ### Credit This vulnerability was discovered and reported by Sławek Naczyński.

CVE-2020-5301 Affected Simplesamlphp/simplesamlphp Versions

1 component(s)
Fixed Versions:
1.18.6
Product / Package Ecosystem Affected Versions Fixed Version
simplesamlphp/simplesamlphp
 Packagist
< 1.18.6
1.18.6

References

GitHub Advisory / Wiki ADVISORY
https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-24m3-w8g9-jwpq
NVD — CVE-2020-5301 NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5301
Security Fix Commit FIX COMMIT
https://github.com/simplesamlphp/simplesamlphp/commit/47968d26a2fd3ed52da70dc09210921d612ce44e
Simplesamlphp/simplesamlphp Source Repository REPOSITORY
https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2020-5301.yaml
Simplesamlphp/simplesamlphp Source Repository REPOSITORY
https://github.com/simplesamlphp/simplesamlphp
Simplesamlphp/simplesamlphp Security Information SECURITY
https://simplesamlphp.org/security/202004-01

Frequently Asked Questions

What is CVE-2020-5301?
CVE-2020-5301 is a security vulnerability in Simplesamlphp/simplesamlphp involving Information disclosure of source code in SimpleSAMLphp under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Which Simplesamlphp/simplesamlphp versions are affected?
Affected versions include releases prior to 1.18.6 across affected packages: simplesamlphp/simplesamlphp.
What version fixes CVE-2020-5301?
Upgrading to 1.18.6 (or the latest patched release for your respective branch) resolves the vulnerability.
Is simplesamlphp/simplesamlphp affected?
Yes, simplesamlphp/simplesamlphp is affected in releases prior to 1.18.6. Upgrade your dependency to 1.18.6 or later.
What is the CVSS score of CVE-2020-5301?
CVE-2020-5301 has a CVSS v3.1 base score of 3.0 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N.
What CWE is associated with CVE-2020-5301?
CVE-2020-5301 is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.).
How can I check Packagist dependencies for CVE-2020-5301?
Run the dependency tree command: 'inspect dependencies for simplesamlphp/simplesamlphp'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-24m3-w8g9-jwpq",
  "modified" : "2024-02-06T13:27:42Z",
  "published" : "2020-04-22T20:59:44Z",
  "aliases" : [ "CVE-2020-5301" ],
  "summary" : "Information disclosure of source code in SimpleSAMLphp",
  "details" : "### Background\n\nThe module controller in `SimpleSAML\\Module` that processes requests for pages\nhosted by modules, has code to identify paths ending with `.php` and process\nthose as PHP code. If no other suitable way of handling the given path exists it\npresents the file to the browser.\n\n### Description\n\nThe check to identify paths ending with `.php` does not account for uppercase\nletters. If someone requests a path ending with e.g. `.PHP` and the server is\nserving the code from a case-insensitive file system, such as on Windows, the\nprocessing of the PHP code does not occur, and the source code is instead\npresented to the browser.\n\n### Affected versions\n\nSimpleSAMLphp versions **1.18.5 and older**.\n\n### Impact\n\nAn attacker may use this issue to gain access to the source code in third-party\nmodules that is meant to be private, or even sensitive. However, the attack\nsurface is considered small, as the attack will only work when SimpleSAMLphp\nserves such content from a file system that is not case-sensitive, such as on\nWindows.\n\n### Resolution\n\nUpgrade the SimpleSAMLphp installation to version **1.18.6**.\n\n### Credit\n\nThis vulnerability was discovered and reported by Sławek Naczyński.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "simplesamlphp/simplesamlphp"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.18.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-24m3-w8g9-jwpq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-5301"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/simplesamlphp/simplesamlphp/commit/47968d26a2fd3ed52da70dc09210921d612ce44e"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2020-5301.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/simplesamlphp/simplesamlphp"
  }, {
    "type" : "WEB",
    "url" : "https://simplesamlphp.org/security/202004-01"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-178", "CWE-200" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-04-21T19:50:30Z",
    "nvd_published_at" : "2020-04-21T20:15:00Z"
  }
}