CVE-2020-5225: Log injection in SimpleSAMLphp
Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID. When configured to use the file logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the reportID parameter received in a request sent to www/errorreport.php was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SimpleSAMLphpto a version that resolves this vulnerability.Fixed in 1.18.4 - Compensating control
If using the file logging handler in SimpleSAMLphp, ensure attackers cannot influence errorreport.php inputs to prevent newline log-line injection (file logging appends each log line to a given file).
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5225?
The severity of CVE-2020-5225 is medium with a CVSS score of 5.4.
How does CVE-2020-5225 affect SimpleSAMLphp?
CVE-2020-5225 affects SimpleSAMLphp versions up to 1.18.4.
What is log injection?
Log injection is a vulnerability where an attacker can inject malicious data into log files to manipulate or disrupt the logging process.
What is the impact of CVE-2020-5225?
The impact of CVE-2020-5225 allows an attacker, under specific circumstances, to inject arbitrary log entries and potentially escalate their privileges.
How can I fix CVE-2020-5225?
To fix CVE-2020-5225, update SimpleSAMLphp to version 1.18.4 or later.