CVE-2023-49087: Simplesamlphp/xml security Validation Of SignedInfo Vulnerability
HIGHCVE-2023-49087 is a HIGH (CVSS 7.5) validation of signedinfo vulnerability (CWE-345: Insufficient Verification of Data Authenticity) affecting Simplesamlphp/xml security libraries in the Packagist ecosystem. The issue involves validation of signedinfo. Remediation is available by upgrading affected packages to version 1.6.12, 5.0.0-alpha.13.
CVE-2023-49087 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
How to Fix CVE-2023-49087
To remediate this vulnerability, upgrade all affected Simplesamlphp/xml security dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade simplesamlphp/xml-security to 1.6.12Upgrade simplesamlphp/saml2 to 5.0.0-alpha.13Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for simplesamlphp/xml-securityHow to Check if You Are Affected
To determine whether your application is affected by CVE-2023-49087, inspect your project dependencies for Simplesamlphp/xml security:
inspect dependencies for simplesamlphp/xml-securityAnalyze the terminal output to locate any version of Simplesamlphp/xml security in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.6.12), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-345: Insufficient Verification of Data Authenticity, where the product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. In Simplesamlphp/xml security, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2023-49087 Affected Simplesamlphp/xml security Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
simplesamlphp/xml-security
|
Packagist |
≥ 1.6.11
< 1.6.12
All 1 versions
1.6.11
|
1.6.12
|
|
simplesamlphp/saml2
|
Packagist |
≥ 5.0.0-alpha.12
< 5.0.0-alpha.13
All 1 versions
5.0.0-alpha.12
|
5.0.0-alpha.13
|
References
Frequently Asked Questions
What is CVE-2023-49087?
Which Simplesamlphp/xml security versions are affected?
What version fixes CVE-2023-49087?
Is simplesamlphp/xml-security affected?
Is simplesamlphp/saml2 affected?
What is the CVSS score of CVE-2023-49087?
What CWE is associated with CVE-2023-49087?
How can I check Packagist dependencies for CVE-2023-49087?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-ww7x-3gxh-qm6r",
"modified" : "2023-12-06T21:08:04Z",
"published" : "2023-11-28T18:52:19Z",
"aliases" : [ "CVE-2023-49087" ],
"summary" : "Validation of SignedInfo",
"details" : "Validation of an XML Signature requires verification that the hash value of the related XML-document (after any optional transformations and/or normalizations) matches a specific DigestValue-value, but also that the cryptografic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key.\n\nWithin the simpleSAMLphp/xml-security library (https://github.com/simplesamlphp/xml-security), the hash is being validated using SignedElementTrait::validateReference, and the signature is being verified in SignedElementTrait::verifyInternal\n\nhttps://github.com/simplesamlphp/xml-security/blob/master/src/XML/SignedElementTrait.php:\n\n\n\nWhat stands out is that the signature is being calculated over the canonical version of the SignedInfo-tree. The validateReference method, however, uses the original non-canonicalized version of SignedInfo.\n\n### Impact\nIf an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be potentially be possible to forge the signature. No possibilities to exploit this were found during the investigation.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "simplesamlphp/xml-security"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.6.11"
}, {
"fixed" : "1.6.12"
} ]
} ],
"versions" : [ "1.6.11" ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "simplesamlphp/saml2"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.0.0-alpha.12"
}, {
"fixed" : "5.0.0-alpha.13"
} ]
} ],
"versions" : [ "5.0.0-alpha.12" ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6r"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-49087"
}, {
"type" : "WEB",
"url" : "https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/simplesamlphp/xml-security"
}, {
"type" : "WEB",
"url" : "https://github.com/simplesamlphp/xml-security/blob/master/src/XML/SignedElementTrait.php"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-345" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2023-11-28T18:52:19Z",
"nvd_published_at" : "2023-11-30T06:15:47Z"
}
}