Validation of SignedInfo
Validation of an XML Signature requires verification that the hash value of the related XML-document (after any optional transformations and/or normalizations) matches a specific DigestValue-value, but also that the cryptografic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key.
Within the simpleSAMLphp/xml-security library (https://github.com/simplesamlphp/xml-security), the hash is being validated using SignedElementTrait::validateReference, and the signature is being verified in SignedElementTrait::verifyInternal
https://github.com/simplesamlphp/xml-security/blob/master/src/XML/SignedElementTrait.php:
What stands out is that the signature is being calculated over the canonical version of the SignedInfo-tree. The validateReference method, however, uses the original non-canonicalized version of SignedInfo.
Impact
If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be potentially be possible to forge the signature. No possibilities to exploit this were found during the investigation.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | simplesamlphp/saml2 | >= 5.0.0-alpha.12, < 5.0.0-alpha.13 | 5.0.0-alpha.13 |
| Composer package | simplesamlphp/xml-security | >= 1.6.11, < 1.6.12 | 1.6.12 |
References
- https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6r
- https://nvd.nist.gov/vuln/detail/CVE-2023-49087
- https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581
- https://github.com/simplesamlphp/xml-security
- https://github.com/simplesamlphp/xml-security/blob/master/src/XML/SignedElementTrait.php
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-345- Platform
- Composer
- Package
simplesamlphp/saml2, simplesamlphp/xml-security- Disclosed
- 28.11.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-ww7x-3gxh-qm6r - CC BY 4.0
Vulnerability history: simplesamlphp/xml-security
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 11.2023 03.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
Disclosures per year
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 1
-
Validation of SignedInfo this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.