SimpleSAMLphp 1.17 includes a preview of the new user interface to be included in the future version 2.0. This new user
interface can be enabled by setting the
usenewui configuration option to
true, and it includes a new admin interface
in a module called admin, which can be disabled.
The new admin interface includes a way to view information about the host where SimpleSAMLphp is installed, by means of
phpinfo() PHP function. An endpoint that exposes the output of that function is included in the admin module for
The aforementioned endpoint had no checks for administrator privileges. This would allow any individual to access the given endpoint without authenticating, gathering information about the affected system.
All SimpleSAMLphp 1.17 versions up to 1.17.7 are affected, provided that the new, experimental use interface is enabled, together with the new admin module.
An attacker could leverage this issue by accessing the unprotected endpoint and gather intelligence about the host where SimpleSAMLphp is deployed, using it later for their own advantage in case other issues arise.
However, the impact of this issue is deemed as low, given that the new user interface must be explicitly enabled by
means of the
usenewui configuration option, and the new admin module must also be enabled.
Upgrade to SimpleSAMLphp 1.17.8 or 1.18. This can be done by downloading the package, or by running
Refer to the documentation for instructions on how to
Alternatively, the issue can be mitigated by either disabling the new user interface by setting the
configuration option to
false, or by disabling the admin module in the configuration:
'module.enable' => [ ... 'admin' => false, ... ],
This security issue was reported by Dirk-jan Mollema and reported on November 19, 2019.