[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/SIMPLESAML-PHP-LINK-INJECTION.txt [+] ISR: apparitionsec Vendor: ================= simplesamlphp.org Product: ====================== simplesamlphp < 1.14.4 Vulnerability Type: =================== Link Injection CVE Reference: ============== N/A Vulnerability Details: ===================== Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This is supposed to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out. The following scripts do not check the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on: www/logout.php modules/core/www/no_cookie.php The issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack of security checks involving the link_href and retryURL HTTP parameters, respectively. The issue was resolved by including a verification of the URLs received in the request against a white list of websites specified in the trusted.url.domains configuration option. References: https://simplesamlphp.org/security/201606-01 Affected versions: All SimpleSAMLphp versions prior to 1.14.4. Impact: A remote attacker could craft a link or pop up webpage pointing to a trusted website running SimpleSAMLphp, including a parameter pointing to a malicious website, to fool the victim into visiting that website by clicking on a link in the page presented by the "trusted" SimpleSAMLphp application. Vulnerable Codes: "no_cookie.php" ... ====================== if (isset($_REQUEST['retryURL'])) { $retryURL = (string)$_REQUEST['retryURL']; $retryURL = SimpleSAMLUtilsHTTP::normalizeURL($retryURL); } else { $retryURL = NULL; } $globalConfig = SimpleSAML_Configuration::getInstance(); $t = new SimpleSAML_XHTML_Template($globalConfig, 'core:no_cookie.tpl.php'); $t->data['retryURL'] = $retryURL; $t->show(); "logout.php" ... ==================== if (array_key_exists('link_href', $_REQUEST)) { $link = (string) $_REQUEST['link_href']; $link = SimpleSAMLUtilsHTTP::normalizeURL($link); } else { $link = 'index.php'; } if (array_key_exists('link_text', $_REQUEST)) { $text = $_REQUEST['link_text']; } else { $text = '{logout:default_link_text}'; } $t = new SimpleSAML_XHTML_Template($config, 'logout.php'); $t->data['link'] = $link; $t->data['text'] = $text; $t->show(); Exploit code(s): =============== 1) https://victim-server/simplesaml/module.php/core/no_cookie.php?retryURL=https://attacker-server 2) https://victim-server/simplesaml/logout.php?link_href=http://attacker-server/Evil.php&link_text=PLEASE%20DOWNLOAD%20THIS%20IMPORTANT%20UPDATE Disclosure Timeline: =================================== Vendor Notification: May 31, 2016 June 9, 2016 : Public Disclosure Exploitation Technique: ======================= Remote Severity Level: ================ Low [+] Disclaimer The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. # Iranian Exploit DataBase = http://IeDb.Ir [2016-06-24]