simplesamlphp · SimpleSAMLphp
Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID. When configured to use the file logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the reportID parameter received in a request sent to www/errorreport.php was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.
Disclosed on 24 Jan 2020. No public exploit code or confirmed exploitation is recorded.
7 fixes in simplesamlphp/simplesamlphp over 9 years. The latest fix listed for simplesamlphp/simplesamlphp is 2.5.2.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: simplesamlphp/simplesamlphp.
Upgrade to 1.18.4 or later
Set the version to 1.18.4 or later in your composer.json.
The first fix for CVE-2020-5225. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 1.18.4 | 1.18.4 |
“Up to” means the second version is the fix and is not affected.