Information disclosure of source code in SimpleSAMLphp
Background
The module controller in SimpleSAML\Module that processes requests for pages
hosted by modules, has code to identify paths ending with .php and process
those as PHP code. If no other suitable way of handling the given path exists it
presents the file to the browser.
Description
The check to identify paths ending with .php does not account for uppercase
letters. If someone requests a path ending with e.g. .PHP and the server is
serving the code from a case-insensitive file system, such as on Windows, the
processing of the PHP code does not occur, and the source code is instead
presented to the browser.
Affected versions
SimpleSAMLphp versions 1.18.5 and older.
Impact
An attacker may use this issue to gain access to the source code in third-party modules that is meant to be private, or even sensitive. However, the attack surface is considered small, as the attack will only work when SimpleSAMLphp serves such content from a file system that is not case-sensitive, such as on Windows.
Resolution
Upgrade the SimpleSAMLphp installation to version 1.18.6.
Credit
This vulnerability was discovered and reported by Sławek Naczyński.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | simplesamlphp/simplesamlphp | < 1.18.6 | 1.18.6 |
Referencias
- https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-24m3-w8g9-jwpq
- https://nvd.nist.gov/vuln/detail/CVE-2020-5301
- https://github.com/simplesamlphp/simplesamlphp/commit/47968d26a2fd3ed52da70dc09210921d612ce44e
- https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2020-5301.yaml
- https://github.com/simplesamlphp/simplesamlphp
- https://simplesamlphp.org/security/202004-01
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N- Debilidad (CWE)
CWE-178, CWE-200- Plataforma
- Composer
- Paquete
simplesamlphp/simplesamlphp- Publicada
- 22.04.2020
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-24m3-w8g9-jwpq - CC BY 4.0
Historial de vulnerabilidades: simplesamlphp/simplesamlphp
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 23
- Primera → última
- 01.2020 07.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 3
- Alta 4
- Media 12
- Baja 4
Divulgaciones por año
- 2020: 6
- 2021: 0
- 2022: 12
- 2023: 0
- 2024: 4
- 2025: 0
- 2026: 1
-
Information disclosure of source code in SimpleSAMLphp esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.