Summary
The login() function at line 130 passes the raw user-supplied value $_REQUEST['idp'] directly to SimpleSAMLphp's requireAuth() with only a regex check that the string starts with 'https://'. No validation is performed against a list of configured, trusted IdP entity IDs. An unauthenticated attacker can supply any HTTPS URL pointing to an IdP they control.
PoC
//api/src/Auth/Saml.php
function login()
{
// login (redirects to IdP)
$as = new SimpleSAML\Auth\Simple(self::$auth_source);
$as->requireAuth(preg_match('|^https://|', $_REQUEST['idp']) ?
['saml:idp' => $_REQUEST['idp']] : []);Impact
An attacker can redirect authentication to a malicious IdP to capture credentials via phishing, or, if the SimpleSAMLphp configuration does not strictly validate IdP metadata, issue forged SAML assertions to authenticate as any user, including administrators.
Remediation
Validate the idp request parameter against a pre-configured whitelist of trusted IdP entity IDs stored in the application's SAML configuration. Reject and log any idp value not explicitly present in the trusted list before calling requireAuth().
smitocaru Reporter
Summary
The login() function at line 130 passes the raw user-supplied value
$_REQUEST['idp']directly to SimpleSAMLphp'srequireAuth()with only a regex check that the string starts with 'https://'. No validation is performed against a list of configured, trusted IdP entity IDs. An unauthenticated attacker can supply any HTTPS URL pointing to an IdP they control.PoC
Impact
An attacker can redirect authentication to a malicious IdP to capture credentials via phishing, or, if the SimpleSAMLphp configuration does not strictly validate IdP metadata, issue forged SAML assertions to authenticate as any user, including administrators.
Remediation
Validate the idp request parameter against a pre-configured whitelist of trusted IdP entity IDs stored in the application's SAML configuration. Reject and log any idp value not explicitly present in the trusted list before calling requireAuth().