SimpleSAMLphp Link Injection

[hyp3rlinx@xxxxxxxxx]

[+] Credits: John Page aka hyp3rlinx 

[+] Website: hyp3rlinx.altervista.org

[+] Source:  
http://hyp3rlinx.altervista.org/advisories/SIMPLESAML-PHP-LINK-INJECTION.txt

[+] ISR: apparitionsec



Vendor:
=================
simplesamlphp.org



Product:
======================
simplesamlphp < 1.14.4



Vulnerability Type:
===================
Link Injection



CVE Reference:
==============
N/A



Vulnerability Details:
=====================

Several scripts part of SimpleSAMLphp display a web page with links obtained 
from the request parameters. This is supposed to enhance
usability, as the users are presented with links they can follow after 
completing a certain action, like logging out.

The following scripts do not check the URLs obtained via the HTTP request 
before displaying them as the target of links that the user
may click on:

www/logout.php
modules/core/www/no_cookie.php

The issue allowed attackers to display links targeting a malicious website 
inside a trusted site running SimpleSAMLphp, due to the lack
of security checks involving the link_href and retryURL HTTP parameters, 
respectively. The issue was resolved by including a verification
of the URLs received in the request against a white list of websites specified 
in the trusted.url.domains configuration option.


References:
https://simplesamlphp.org/security/201606-01

Affected versions:
All SimpleSAMLphp versions prior to 1.14.4.

Impact:
A remote attacker could craft a link or pop up webpage pointing to a trusted 
website running SimpleSAMLphp, including a parameter pointing
to a malicious website, to fool the victim into visiting that website by 
clicking on a link in the page presented by the "trusted" SimpleSAMLphp
application.


Vulnerable Codes:


"no_cookie.php" ...
======================


if (isset($_REQUEST['retryURL'])) {
        $retryURL = (string)$_REQUEST['retryURL'];
        $retryURL = \SimpleSAML\Utils\HTTP::normalizeURL($retryURL);
} else {
        $retryURL = NULL;
}

$globalConfig = SimpleSAML_Configuration::getInstance();
$t = new SimpleSAML_XHTML_Template($globalConfig, 'core:no_cookie.tpl.php');
$t->data['retryURL'] = $retryURL;
$t->show();


"logout.php" ... 
====================


if (array_key_exists('link_href', $_REQUEST)) {
    $link = (string) $_REQUEST['link_href'];
    $link = \SimpleSAML\Utils\HTTP::normalizeURL($link);
} else {
    $link = 'index.php';
}

if (array_key_exists('link_text', $_REQUEST)) {
    $text = $_REQUEST['link_text'];
} else {
    $text = '{logout:default_link_text}';
}

$t = new SimpleSAML_XHTML_Template($config, 'logout.php');
$t->data['link'] = $link;
$t->data['text'] = $text;
$t->show();



Exploit code(s):
===============


1) 
https://victim-server/simplesaml/module.php/core/no_cookie.php?retryURL=https://attacker-server


2) 
https://victim-server/simplesaml/logout.php?link_href=http://attacker-server/Evil.php&link_text=PLEASE%20DOWNLOAD%20THIS%20IMPORTANT%20UPDATE



Disclosure Timeline:
===================================
Vendor Notification:  May 31, 2016
June 9, 2016  : Public Disclosure




Exploitation Technique:
=======================
Remote



Severity Level:
================
Low



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no 
warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided 
that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in 
vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the 
information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author 
prohibits any malicious use of security related information
or exploits by the author or elsewhere.

hyp3rlinx