CVE-2018-5387 Wizkunde SAMLBase SAML Bypass
Attackers can bypass SAML authentication by manipulating XML data without invalidating signatures, potentially gaining unauthorized access to service providers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-5387?
CVE-2018-5387 is a high-severity authentication bypass vulnerability in Wizkunde SAMLBase, published on 24 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Which versions are affected by CVE-2018-5387?
2 open source packages ship an affected version, including gogentooss/samlbase. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gogentooss/samlbase Packagist | All versions | 1.2.7 |
gogentooss/samlbase Packagist | All versions | 1.2.7 |
Products include Wizkunde Samlbase.
How do I fix CVE-2018-5387?
Upgrade gogentooss/samlbase to 1.2.7 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-5387 being exploited?
There is no known exploitation of CVE-2018-5387 in the wild and no public exploit code.
Sources
Also known as GHSA-7gh2-8q93-87hp.