# GHSA-ppm4-r2vc-pg74: SimpleSAMLphp Information Disclosure vulnerability

> Unauthenticated attackers can access phpinfo output via an unprotected admin endpoint if the experimental UI and admin module are enabled.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 28 May 2024

## What is GHSA-ppm4-r2vc-pg74?

GHSA-ppm4-r2vc-pg74 is a vulnerability in simplesamlphp/simplesamlphp, published on 28 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Background
SimpleSAMLphp 1.17 includes a preview of the new user interface to be included in the future version 2.0. This new user interface can be enabled by setting the usenewui configuration option to true, and it includes a new admin interface in a module called admin, which can be disabled.

### Description
The new admin interface includes a way to view information about the host where SimpleSAMLphp is installed, by means of the phpinfo() PHP function. An endpoint that exposes the output of that function is included in the admin module for easier debugging.

The aforementioned endpoint had no checks for administrator privileges. This would allow any individual to access the given endpoint without authenticating, gathering information about the affected system.

### Affected versions
All SimpleSAMLphp 1.17 versions up to 1.17.7 are affected, provided that the new, experimental use interface is enabled, together with the new admin module.

### Impact
An attacker could leverage this issue by accessing the unprotected endpoint and gather intelligence about the host where SimpleSAMLphp is deployed, using it later for their own advantage in case other issues arise.

However, the impact of this issue is deemed as low, given that the new user interface must be explicitly enabled by means of the usenewui configuration option, and the new admin module must also be enabled.

### Resolution
Upgrade to SimpleSAMLphp 1.17.8 or 1.18. This can be done by downloading the package, or by running composer update. Refer to the documentation for instructions on how to run composer.

Alternatively, the issue can be mitigated by either disabling the new user interface by setting the usenewui configuration option to false, or by disabling the admin module in the configuration:
```
    'module.enable' => [
        ...
        'admin' => false,
        ...
    ],
```

## Which versions are affected by GHSA-ppm4-r2vc-pg74?

2 open source packages ship an affected version, including simplesamlphp/simplesamlphp.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `simplesamlphp/simplesamlphp` | Packagist | From 1.17.0 | 1.17.8 |
| `simplesamlphp/simplesamlphp` | Packagist | From 1.17.0 | 1.17.8 |

## How do I fix GHSA-ppm4-r2vc-pg74?

Upgrade simplesamlphp/simplesamlphp to 1.17.8 or later.

## Is GHSA-ppm4-r2vc-pg74 being exploited?

There is no known exploitation of GHSA-ppm4-r2vc-pg74 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-ppm4-r2vc-pg74 and fix it if it is affected.

What it is: GHSA-ppm4-r2vc-pg74 is a vulnerability in simplesamlphp/simplesamlphp, published on 28 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-ppm4-r2vc-pg74 in the wild and no public exploit code.

Affected packages and fixed versions:
- simplesamlphp/simplesamlphp (Packagist): affected from 1.17.0; fixed in 1.17.8
- simplesamlphp/simplesamlphp (Packagist): affected from 1.17.0; fixed in 1.17.8

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-ppm4-r2vc-pg74/ (Markdown: https://insights.sbomify.com/GHSA-ppm4-r2vc-pg74/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-ppm4-r2vc-pg74

---
From sbomify Insights: https://insights.sbomify.com/GHSA-ppm4-r2vc-pg74/
Summaries are generated and may contain mistakes; the official description above is the record.