simplesamlphp Link Injection

`[+] Credits: John Page aka hyp3rlinx  
  
[+] Website: hyp3rlinx.altervista.org  
  
[+] Source:  
http://hyp3rlinx.altervista.org/advisories/SIMPLESAML-PHP-LINK-INJECTION.txt  
  
[+] ISR: apparitionsec  
  
  
  
Vendor:  
=================  
simplesamlphp.org  
  
  
  
Product:  
======================  
simplesamlphp < 1.14.4  
  
  
  
Vulnerability Type:  
===================  
Link Injection  
  
  
  
CVE Reference:  
==============  
N/A  
  
  
  
Vulnerability Details:  
=====================  
  
Several scripts part of SimpleSAMLphp display a web page with links  
obtained from the request parameters. This is supposed to enhance  
usability, as the users are presented with links they can follow after  
completing a certain action, like logging out.  
  
The following scripts do not check the URLs obtained via the HTTP request  
before displaying them as the target of links that the user  
may click on:  
  
www/logout.php  
modules/core/www/no_cookie.php  
  
The issue allowed attackers to display links targeting a malicious website  
inside a trusted site running SimpleSAMLphp, due to the lack  
of security checks involving the link_href and retryURL HTTP parameters,  
respectively. The issue was resolved by including a verification  
of the URLs received in the request against a white list of websites  
specified in the trusted.url.domains configuration option.  
  
  
References:  
https://simplesamlphp.org/security/201606-01  
  
Affected versions:  
All SimpleSAMLphp versions prior to 1.14.4.  
  
Impact:  
A remote attacker could craft a link or pop up webpage pointing to a  
trusted website running SimpleSAMLphp, including a parameter pointing  
to a malicious website, to fool the victim into visiting that website by  
clicking on a link in the page presented by the "trusted" SimpleSAMLphp  
application.  
  
  
Vulnerable Codes:  
  
  
"no_cookie.php" ...  
======================  
  
  
if (isset($_REQUEST['retryURL'])) {  
$retryURL = (string)$_REQUEST['retryURL'];  
$retryURL = \SimpleSAML\Utils\HTTP::normalizeURL($retryURL);  
} else {  
$retryURL = NULL;  
}  
  
$globalConfig = SimpleSAML_Configuration::getInstance();  
$t = new SimpleSAML_XHTML_Template($globalConfig, 'core:no_cookie.tpl.php');  
$t->data['retryURL'] = $retryURL;  
$t->show();  
  
  
"logout.php" ...  
====================  
  
  
if (array_key_exists('link_href', $_REQUEST)) {  
$link = (string) $_REQUEST['link_href'];  
$link = \SimpleSAML\Utils\HTTP::normalizeURL($link);  
} else {  
$link = 'index.php';  
}  
  
if (array_key_exists('link_text', $_REQUEST)) {  
$text = $_REQUEST['link_text'];  
} else {  
$text = '{logout:default_link_text}';  
}  
  
$t = new SimpleSAML_XHTML_Template($config, 'logout.php');  
$t->data['link'] = $link;  
$t->data['text'] = $text;  
$t->show();  
  
  
  
Exploit code(s):  
===============  
  
  
1)  
https://victim-server/simplesaml/module.php/core/no_cookie.php?retryURL=https://attacker-server  
  
  
2)  
https://victim-server/simplesaml/logout.php?link_href=http://attacker-server/Evil.php&link_text=PLEASE%20DOWNLOAD%20THIS%20IMPORTANT%20UPDATE  
  
  
  
Disclosure Timeline:  
===================================  
Vendor Notification: May 31, 2016  
June 9, 2016 : Public Disclosure  
  
  
  
  
Exploitation Technique:  
=======================  
Remote  
  
  
  
Severity Level:  
================  
Low  
  
  
  
[+] Disclaimer  
The information contained within this advisory is supplied "as-is" with no  
warranties or guarantees of fitness of use or otherwise.  
Permission is hereby granted for the redistribution of this advisory,  
provided that it is not altered except by reformatting it, and  
that due credit is given. Permission is explicitly given for insertion in  
vulnerability databases and similar, provided that due credit  
is given to the author. The author is not responsible for any misuse of the  
information contained herein and accepts no responsibility  
for any damage caused by the use or misuse of this information. The author  
prohibits any malicious use of security related information  
or exploits by the author or elsewhere.  
  
hyp3rlinx  
`