CVE-2014-4172: Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.
Other sources
It was found that URL encoding used in the back-channel ticket validation of the JA-SIG CAS client was improper. A remote attacker could exploit this flaw to bypass security constraints by injecting URL parameters.
— Red Hat
Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/jasig/phpcasto a version that resolves this vulnerability.Fixed in 1.3.3 - Upgrade
Upgrade
maven/org.jasig.cas:cas-clientto a version that resolves this vulnerability.Fixed in 3.3.2 - Upgrade
Upgrade
nuget/DotNetCasClientto a version that resolves this vulnerability.Fixed in 1.0.2 - Upgrade
Upgrade
redhat/cas-clientto a version that resolves this vulnerability.Fixed in 3.3.2 - Upgrade
Upgrade
redhat/cas-client-coreto a version that resolves this vulnerability.Fixed in 3.3.2 - Upgrade
Upgrade
debian/php-casto a version that resolves this vulnerability.Fixed in 1.3.8-1Fixed in 1.6.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4172?
CVE-2014-4172 is considered to have a high severity due to the potential for remote code execution through URL parameter injection.
How do I fix CVE-2014-4172?
To fix CVE-2014-4172, upgrade to Jasig Java CAS Client version 3.3.2, .NET CAS Client version 1.0.2, or phpCAS version 1.3.3 or later.
What systems are affected by CVE-2014-4172?
CVE-2014-4172 affects the Jasig Java CAS Client versions prior to 3.3.2, .NET CAS Client versions prior to 1.0.2, and phpCAS versions prior to 1.3.3.
What exploit methods are used for CVE-2014-4172?
CVE-2014-4172 can be exploited through URL parameter injection, allowing attackers to inject arbitrary web scripts or HTML.
Is there a potential impact from CVE-2014-4172 if exploited?
If exploited, CVE-2014-4172 could lead to unauthorized access to sensitive user information and could compromise the integrity of web applications.