SimpleSAMLphp vulnerable to XXE in parsing SAML messages
Date: 2024-12
Affected: composer/simplesamlphp/simplesamlphp, composer/simplesamlphp/simplesamlphp, composer/simplesamlphp/simplesamlphp
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-52596
CWE: CWE-611
CVSS: 8.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L)

## Withdrawn Advisory This advisory has been withdrawn because the vulnerability affects users of the SimpleSAMLphp tarball, not the SimpleSAMLphp Composer package. The underlying information about CVE-2024-52596 is still valid. ## Original Description # Summary When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. ## Mitigation: Remove the `LIBXML_DTDLOAD | LIBXML_DTDATTR` options from `$options` is in: https://github.com/simplesamlphp/saml2/blob/717c0adc4877ebd58428637e5626345e59fa0109/src/SAML2/DOMDocumentFactory.php#L41 ## Background / details To be published on Dec 8th


Mitigations:

Architectural layers (MAESTRO):