{"answers":{"affected":"2 open source packages ship an affected version, including simplesamlphp/simplesamlphp.","exploited":"There is no known exploitation of GHSA-7wh8-jrq7-p27f in the wild and no public exploit code.","fix":"Upgrade simplesamlphp/simplesamlphp to 1.16.3 or later.","what":"GHSA-7wh8-jrq7-p27f is a vulnerability in simplesamlphp/simplesamlphp, published on 28 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-7wh8-jrq7-p27f and fix it if it is affected.\n\nWhat it is: GHSA-7wh8-jrq7-p27f is a vulnerability in simplesamlphp/simplesamlphp, published on 28 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-7wh8-jrq7-p27f in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- simplesamlphp/simplesamlphp (Packagist): affected from 1.16.0; fixed in 1.16.3\n- simplesamlphp/simplesamlphp (Packagist): affected from 1.16.0; fixed in 1.16.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-7wh8-jrq7-p27f/ (Markdown: https://insights.sbomify.com/GHSA-7wh8-jrq7-p27f/index.md)","id":"GHSA-7wh8-jrq7-p27f","markdown":"https://insights.sbomify.com/GHSA-7wh8-jrq7-p27f/index.md","name":"GHSA-7wh8-jrq7-p27f","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"SAML Identity Provider","requires_auth":"none","summary":"An attacker can obtain user credentials stored in session files when the ECP profile is disabled but metadata supports it.","user_interaction":"required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Background\nIn order to implement support for the SAML Enhanced Client or Proxy profile, the credentials obtained for authentication were stored in the state in order to pass them to the relevant routines. This, however, led to the credentials being recorded in the user’s session, which can be stored in permanent storage such as the local file system or a remote memcache or database server.\n\n### Description\nWhen an authentication request is received via the ECP profile, the username and password obtained this way were saved to the state array, which is used to pass relevant data to different routines that may need it. This is not a problem in itself. However, when the ECP profile is disabled in the Identity Provider, other bindings such as HTTP-POST or HTTP-Redirect will be used, and since redirections are involved, the state array is then persisted to the user’s session, effectively storing it in the session backend.\n\nThe ECP profile, which uses the SOAP and PAOS bindings, does not involve any HTTP redirection for the user, and for that reason the state array containing the credentials is never persisted to the session. The logic for determining when to save the credentials to the state array assumed wrongly, though, that if the authentication request came in on the SOAP binding, that means the ECP profile is used. This may not be true as ECP can be disabled by configuration in the IdP’s hosted SAML metadata, and in that case SimpleSAMLphp would then try to default to a binding different than PAOS, such as HTTP-POST or HTTP-Redirect, effectively consolidating the entire state array to the user’s session as described before.\n\nIn practice, any Identity Provider with the ECP profile disabled but metadata for an entity that supports ECP, would reject incoming ECP requests, but write the credentials obtained in the request to the user’s session, which will be stored in the session store, whichever is used (local file system in case PHP sessions are used, Memcache, Redis, relational databases, etc).\n\n### Affected versions\nAll SimpleSAMLphp versions 1.16.x are affected, up to 1.16.2.\n\n### Impact\nAn Identity Provider with metadata for trusted entities that support the SAML ECP profile, may end up storing the user’s credentials received from such entities in its own session storage, whatever that is, in case ECP is actually not enabled in the IdP. Under such circumstances, the credentials may be then accessible to administrators, other personnel or even malicious parties who may have access to the systems where sessions or their backups are stored.","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"SimpleSAMLphp exposes credentials in session storage","id":"GHSA-7wh8-jrq7-p27f","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"information_disclosure","year":"2024"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["1.16.3"],"introduced":["1.16.0"],"last_affected":[],"package":"simplesamlphp/simplesamlphp","purl":null,"source":"GHSA-7wh8-jrq7-p27f"},{"ecosystem":"Packagist","fixed":["1.16.3"],"introduced":["1.16.0"],"last_affected":[],"package":"simplesamlphp/simplesamlphp","purl":"pkg:composer/simplesamlphp/simplesamlphp","source":"GHSA-7wh8-jrq7-p27f"}],"products":null,"published":"2024-05-28","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An attacker can obtain user credentials stored in session files when the ECP profile is disabled but metadata supports it.","url":"https://insights.sbomify.com/GHSA-7wh8-jrq7-p27f/"}