CVE-2023-49087: Validation of SignedInfo
First published: Tue Nov 28 2023(Updated: )
Validation of an XML Signature requires verification that the hash value of the related XML-document (after any optional transformations and/or normalizations) matches a specific DigestValue-value, but also that the cryptografic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. Within the simpleSAMLphp/xml-security library (https://github.com/simplesamlphp/xml-security), the hash is being validated using SignedElementTrait::validateReference, and the signature is being verified in SignedElementTrait::verifyInternal https://github.com/simplesamlphp/xml-security/blob/master/src/XML/SignedElementTrait.php:  What stands out is that the signature is being calculated over the canonical version of the SignedInfo-tree. The validateReference method, however, uses the original non-canonicalized version of SignedInfo. ### Impact If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be potentially be possible to forge the signature. No possibilities to exploit this were found during the investigation.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/simplesamlphp/saml2 | =5.0.0-alpha.12 | 5.0.0-alpha.13 |
| composer/simplesamlphp/xml-security | =1.6.11 | 1.6.12 |
| SimpleSAMLphp | =5.0.0-alpha12 | |
| simpleSAMLphp xml-security | =1.6.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581
- https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6r
- https://github.com/simplesamlphp/xml-security/blob/master/src/XML/SignedElementTrait.php
- https://nvd.nist.gov/vuln/detail/CVE-2023-49087
- https://github.com/advisories/GHSA-ww7x-3gxh-qm6r (Advisory)
Frequently Asked Questions
What is CVE-2023-49087?
CVE-2023-49087 is a vulnerability that involves the validation of an XML Signature and the verification of the hash value of the related XML document.
How does CVE-2023-49087 impact the affected software?
CVE-2023-49087 impacts the affected software by allowing an attacker to bypass the verification of the hash value and potentially perform unauthorized actions.
What is the severity of CVE-2023-49087?
CVE-2023-49087 has a severity value of 6.8, which is classified as medium.
How can I fix CVE-2023-49087?
To fix CVE-2023-49087, you should update the affected software to the recommended versions: simplesamlphp/saml2 v5.0.0-alpha.13 and simplesamlphp/xml-security v1.6.12.
Where can I find more information about CVE-2023-49087?
You can find more information about CVE-2023-49087 in the following references: [GitHub Advisory](https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6r), [Commit Details](https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581), and [Source Code](https://github.com/simplesamlphp/xml-security/blob/master/src/XML/SignedElementTrait.php).
- collector/github-advisory-latest
- alias/GHSA-ww7x-3gxh-qm6r
- alias/CVE-2023-49087
- collector/github-advisory
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/references
- agent/description
- agent/title
- agent/weakness
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- package-manager/composer
- vendor/simplesamlphp
- canonical/simplesamlphp
- version/simplesamlphp/5.0.0-alpha12
- canonical/simplesamlphp xml-security
- version/simplesamlphp xml-security/1.6.11