{"answers":{"affected":"2 open source packages ship an affected version, including onelogin/php-saml.","exploited":"There is no known exploitation of GHSA-9wrw-p9rm-r782 in the wild and no public exploit code.","fix":"Upgrade onelogin/php-saml to 2.10.4 or later.","what":"GHSA-9wrw-p9rm-r782 is a vulnerability in onelogin/php-saml, published on 17 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-9wrw-p9rm-r782 and fix it if it is affected.\n\nWhat it is: GHSA-9wrw-p9rm-r782 is a vulnerability in onelogin/php-saml, published on 17 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-9wrw-p9rm-r782 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- onelogin/php-saml (Packagist): affected all versions; fixed in 2.10.4\n- onelogin/php-saml (Packagist): affected all versions; fixed in 2.10.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-9wrw-p9rm-r782/ (Markdown: https://insights.sbomify.com/GHSA-9wrw-p9rm-r782/index.md)","id":"GHSA-9wrw-p9rm-r782","markdown":"https://insights.sbomify.com/GHSA-9wrw-p9rm-r782/index.md","name":"GHSA-9wrw-p9rm-r782","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"PHP SAML library","requires_auth":"none","summary":"An attacker can bypass SAML logout signature validation due to incorrect boolean conversion of error codes, allowing unauthorized session termination.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In order to verify Signatures on Logoutrequests and LogoutResponses we use\nthe verifySignature of the class XMLSecurityKey from the xmlseclibs library.\nThat method end up calling openssl_verify() depending on the signature algorithm used.\n\nThe openssl_verify() function returns 1 when the signature was successfully verified,\n0 if it failed to verify with the given key, and -1 in case an error occurs.\nPHP allows translating numerical values to boolean implicitly, with the following correspondences:\n- 0 equals false.\n- Non-zero equals true.\n\nThis means that an implicit conversion to boolean of the values returned by openssl_verify()\nwill convert an error state, signaled by the value -1, to a successful verification of the\nsignature (represented by the boolean true).\n\nThe LogoutRequest/LogoutResponse signature validator was performing an implicit conversion to boolean\nof the values returned by the verify() method, which subsequently will return the same output\nas openssl_verify() under most circumstances.\nThis means an error during signature verification is treated as a successful verification by the method.\n\nSince the signature validation of SAMLResponses were not affected, the impact of this security\nvulnerability is lower, but an update of the php-saml toolkit is recommended.","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.","id":"GHSA-9wrw-p9rm-r782","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"security_feature_bypass","year":"2024"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["2.10.4"],"introduced":["0"],"last_affected":[],"package":"onelogin/php-saml","purl":null,"source":"GHSA-9wrw-p9rm-r782"},{"ecosystem":"Packagist","fixed":["2.10.4"],"introduced":["0"],"last_affected":[],"package":"onelogin/php-saml","purl":"pkg:composer/onelogin/php-saml","source":"GHSA-9wrw-p9rm-r782"}],"products":null,"published":"2024-05-17","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An attacker can bypass SAML logout signature validation due to incorrect boolean conversion of error codes, allowing unauthorized session termination.","url":"https://insights.sbomify.com/GHSA-9wrw-p9rm-r782/"}