Create 202501-01.md

Author: tvdijen

security/202501-01.md

@@ -0,0 +1,39 @@
+---
+layout: default
+title: "SSPSA 202501-01: Signature bypass vulnerability"
+---
+
+<aside><div class="sidebar-warning right">
+<h2>Date</h2>
+11 March 2025
+<h2>Affected versions</h2>
+
+<code>SimpleSAMLphp 2.3.0 - 2.3.6</code><br/>
+<code>SimpleSAMLphp 2.2.0 - 2.2.4</code><br/>
+
+<code>Any older version</code><br/>
+<h2>Severity</h2>
+High - CVE 8.6
+</div></aside>
+
+# 202501-01
+
+**Signature bypass vulnerability**
+
+### Description
+
+When passing multiple SAMLResponse-parameters, the signature would be validated on the second one instead of the first one.
+
+### Mitigation:
+
+Update to the latest version of SimpleSAMLphp, or manually bump the `simplesamlphp/saml2` dependency to v4.17.0
+
+### Background / details
+
+The HTTPRedirect-binding didn't properly check the query-parameters.
+We've changed it to check for duplicate parameters and any illegal combination of parameters (i.e. both a SAMLResponse and a SAMLRequest).
+
+### Credit
+
+This vulnerability was discovered and reported by ahacker1-securesaml on November 18, 2024.
+It is registered under CVE-2025-27773.