Vulnerability: Information disclosure of source code in SimpleSAMLphp ### Background

The module controller in `SimpleSAML\Module` that processes requests for pages
hosted by modules, has code to identify paths ending with `.php` and process
those as PHP code. If no other suitable way of handling the given path exists it
presents the file to the browser.

### Description

The check to identify paths ending with `.php` does not account for uppercase
letters. If someone requests a path ending with e.g. `.PHP` and the server is
serving the code from a case-insensitive file system, such as on Windows, the
processing of the PHP code does not occur, and the source code is instead
presented to the browser.

### Affected versions

SimpleSAMLphp versions **1.18.5 and older**.

### Impact

An attacker may use this issue to gain access to the source code in third-party
modules that is meant to be private, or even sensitive. However, the attack
surface is considered small, as the attack will only work when SimpleSAMLphp
serves such content from a file system that is not case-sensitive, such as on
Windows.

### Resolution

Upgrade the SimpleSAMLphp installation to version **1.18.6**.

### Credit

This vulnerability was discovered and reported by Sławek Naczyński.
Vulnerability ID: GHSA-24m3-w8g9-jwpq
CWE: CWE-200
Severity score: 3
Project: https://github.com/simplesamlphp/simplesamlphp
Published: 2020-04-22
File: lib/SimpleSAML/Module.php
Commit message: Fix source code disclosure on case-insensitive file systems

If the file system containing the PHP code is case-insensitive, a
request containing an uppercase file extension will return the
contents of the PHP file to the browser instead of executing it.

E.g. a request for this URL will return the source code:

  https:/sp.example.org/simplesaml/module.php/core/frontpage_welcome.PHP

Fix that by converting the path to lowercase before checking the file
extension.

See the following page for details:

  https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-24m3-w8g9-jwpq
Commit author: Olav Morken

Vulnerable version (before fix):
 function ($val) {             throw new Error\NotFound('The URL wasn\'t found in the module.');         }          if (substr($path, -4) === '.php') {             // PHP file - attempt to run it              /* In some environments, $_SERVER['SCRIPT_NAME'] is already set with $_SERVER['PATH_INFO']. Check for that

Fixed version (after fix):
 function ($val) {             throw new Error\NotFound('The URL wasn\'t found in the module.');         }          if (mb_strtolower(substr($path, -4), 'UTF-8') === '.php') {             // PHP file - attempt to run it              /* In some environments, $_SERVER['SCRIPT_NAME'] is already set with $_SERVER['PATH_INFO']. Check for that

Patch:
patch: @@ -259,7 +259,7 @@ function ($val) {
             throw new Error\NotFound('The URL wasn\'t found in the module.');
         }
 
-        if (substr($path, -4) === '.php') {
+        if (mb_strtolower(substr($path, -4), 'UTF-8') === '.php') {
             // PHP file - attempt to run it
 
             /* In some environments, $_SERVER['SCRIPT_NAME'] is already set with $_SERVER['PATH_INFO']. Check for that
path: lib/SimpleSAML/Module.php