CVE-2020-5301 (published 2020-04-21T20:15Z)

SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in `SimpleSAML\\Module` that processes requests for pages hosted by modules, has code to identify paths ending with `.php` and process those as PHP code. If no other suitable way of handling the given path exists it presents the file to the browser. The check to identify paths ending with `.php` does not account for uppercase letters. If someone requests a path ending with e.g. `.PHP` and the server is serving the code from a case-insensitive file system, such as on Windows, the processing of the PHP code does not occur, and the source code is instead presented to the browser. An attacker may use this issue to gain access to the source code in third-party modules that is meant to be private, or even sensitive. However, the attack surface is considered small, as the attack will only work when SimpleSAMLphp serves such content from a file system that is not case-sensitive, such as on Windows. This issue is fixed in version 1.18.6.

Severity: LOW
CVSS v2 base score: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 3.1, LOW (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-178
cwe_name: Improper Handling of Case Sensitivity
description: The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
extended_description: 
            Improperly handled case sensitive data can lead to several possible consequences, including:
               
                  case-insensitive passwords reducing the size of the key space, making brute force attacks easier
                  bypassing filters or access controls using alternate names
                  multiple interpretation errors using alternate names.
               
         
         

Fix information:
repo_url: https://github.com/simplesamlphp/simplesamlphp
commit_details: repo_url: https://github.com/simplesamlphp/simplesamlphp
author: Olav Morken
author_date: 2020-04-16 14:17:24+02:00
msg: Fix source code disclosure on case-insensitive file systems

If the file system containing the PHP code is case-insensitive, a
request containing an uppercase file extension will return the
contents of the PHP file to the browser instead of executing it.

E.g. a request for this URL will return the source code:

  https:/sp.example.org/simplesaml/module.php/core/frontpage_welcome.PHP

Fix that by converting the path to lowercase before checking the file
extension.

See the following page for details:

  https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-24m3-w8g9-jwpq
repository: repo_url: https://github.com/simplesamlphp/simplesamlphp
repo_name: simplesamlphp/simplesamlphp
description: SimpleSAMLphp is an application written in native PHP that deals with authentication.
repo_language: PHP
owner: simplesamlphp
file_changes: filename: Module.php
change_type: ModificationType.MODIFY
diff: @@ -259,7 +259,7 @@ class Module
             throw new Error\NotFound('The URL wasn\'t found in the module.');
         }
 
-        if (substr($path, -4) === '.php') {
+        if (mb_strtolower(substr($path, -4), 'UTF-8') === '.php') {
             // PHP file - attempt to run it
 
             /* In some environments, $_SERVER['SCRIPT_NAME'] is already set with $_SERVER['PATH_INFO']. Check for that

programming_language: PHP