202412-01

XXE in parsing SAML messages

Description

When loading an (untrusted) XML document, for example the SAMLResponse, it’s possible to induce an XXE.

Mitigation:

Remove the LIBXML_DTDLOAD | LIBXML_DTDATTR options from $options is in: https://github.com/simplesamlphp/saml2/blob/717c0adc4877ebd58428637e5626345e59fa0109/src/SAML2/DOMDocumentFactory.php#L41

Background / details

While there is the NONET option, an attacker can simply bypass if by using PHP filters: php://filter/convert.base64-encode/resource=http://URL OR FILE

From there an attacker can induce network connections and steal the targeted file OOB (haven’t fully tested this).

Credit

This vulnerability was discovered and reported by ahacker1-securesaml on November 18, 2024. It is registered under CVE-2024-52596.