201809-01

Insecure signature validation

Background

XMLSecLibs is a library written by Rob Richards that implements the xml-enc and xml-dsig W3C recommendations. It allows its users to handle encrypted and digitally signed XML documents. SimpleSAMLphp delegates encryption and signature handling to this library.

Description

When verifying a digital signature embedded on an XML document, the validateDigest() method of the XMLSecurityDSig class of XMLSecLibs computes the digest of the signed fragment of the document using the algorithm specified. Once this digest is computed, it is then compared to the given digest that's being evaluated (which should be in turn encrypted with the private asymmetric key of the signer). The comparison is performed by means of the regular == PHP operator.

The issue is precisely the use of this operator. Since PHP is a loosely typed language, this operator will convert its operands to integers when possible. This conversion will take into account the values represented by the strings, even supporting scientific number notation. Due to this, PHP will evaluate the strings "1e3" and "1000" as equal.

Given this premise, there is a case where digests can be evaluated equal regardless of their actual values, based only on the integer equivalence they represent. Two strings starting with "0e" and followed by digits will always be evaluated as equal.

Affected versions

All robrichards/xmlseclibs versions 1.x, 2.x and 3.x are affected, up to (including) 1.4.2, 2.0.1 and 3.0.1, respectively.

Impact

An attacker could leverage this issue to modify a signed XML document and have the signature validated without access to the signing key.

However, two prerequisites need to concur to make this issue exploitable, effectively lowering its impact:

The probability of such an event has been considered to be around 2-99.

Resolution

Upgrade to the latest versions of the library.

For SimpleSAMLphp users, run composer update or upgrade to SimpleSAMLphp 1.16. Refer to the documentation for instructions on how to run composer.

Credit

This security issue was discovered during a security audit performed by Cure53 and reported on December 18, 2017.