CVE-2024-52806: SimpleSAMLphp SAML2 XXE Vulnerability

CVE-2024-52806 Overview

CVE-2024-52806 is an XML External Entity (XXE) injection vulnerability affecting the SimpleSAMLphp SAML2 library, a PHP library that provides SAML2 authentication functionality. When the library processes an untrusted XML document, such as a SAMLResponse, attackers can exploit improper XML parsing to induce XXE attacks. This can lead to information disclosure, server-side request forgery (SSRF), and potential denial of service.

Critical Impact

Unauthenticated remote attackers can exploit this XXE vulnerability to read sensitive files, perform SSRF attacks against internal services, or cause service disruption in applications using the affected SimpleSAMLphp SAML2 library versions.

Affected Products

• SimpleSAMLphp SAML2 library versions prior to 4.6.14
• SimpleSAMLphp SAML2 library alpha versions prior to 5.0.0-alpha.18
• Applications implementing SAML2 authentication using vulnerable library versions

Discovery Timeline

• December 2, 2024 - CVE-2024-52806 published to NVD
• December 2, 2024 - Last updated in NVD database

Technical Details for CVE-2024-52806

Vulnerability Analysis

This vulnerability (CWE-611: Improper Restriction of XML External Entity Reference) exists in the SimpleSAMLphp SAML2 library's XML document processing functionality. The library fails to properly disable external entity resolution when parsing XML input, particularly when handling SAML responses during authentication flows.

XXE vulnerabilities in SAML libraries are particularly concerning because SAML authentication inherently involves processing XML documents from external sources (Identity Providers). An attacker who can inject a malicious SAMLResponse or intercept authentication flows can leverage this weakness to access sensitive system files, probe internal network resources, or disrupt authentication services.

The vulnerability allows exploitation across network boundaries without requiring authentication, and successful exploitation can impact resources beyond the vulnerable component itself.

Root Cause

The root cause of this vulnerability is the failure to properly configure the XML parser to disable external entity processing. When the SimpleSAMLphp SAML2 library loads XML documents, it does not adequately restrict the resolution of external entities, allowing attackers to reference external resources or local files within crafted XML payloads. This is a common oversight in XML processing implementations where developers fail to explicitly disable features like LIBXML_NOENT or configure libxml_disable_entity_loader() appropriately.

Attack Vector

The attack vector for CVE-2024-52806 involves crafting a malicious XML document containing external entity declarations and injecting it into the SAML authentication flow. An attacker can exploit this vulnerability by:

1. Intercepting or manipulating a SAMLResponse during an authentication exchange
2. Injecting an XML document with malicious external entity references pointing to sensitive local files (e.g., /etc/passwd) or internal network resources
3. Triggering the vulnerable XML parsing functionality to process the malicious payload
4. Exfiltrating the retrieved data through the SAML response or out-of-band channels

The attack can be conducted remotely without authentication, making it accessible to unauthenticated network attackers targeting applications that implement SAML2 authentication using the vulnerable library.

Detection Methods for CVE-2024-52806

Indicators of Compromise

• Unusual SAML responses containing XML DOCTYPE declarations with ENTITY definitions
• Log entries showing attempts to access sensitive local files (e.g., /etc/passwd, /etc/shadow) through the authentication service
• Outbound network connections from the SAML processing component to unexpected external hosts
• Error messages related to XML parsing failures referencing external entity resolution

Detection Strategies

• Monitor SAML authentication logs for malformed or unusually large SAMLResponse payloads
• Implement web application firewall (WAF) rules to detect XXE patterns in XML payloads
• Deploy network-based intrusion detection systems (IDS) to identify XXE exploitation attempts
• Review application logs for XML parsing errors or unexpected file access attempts

Monitoring Recommendations

• Enable verbose logging for SAML authentication components to capture detailed request information
• Implement file integrity monitoring on sensitive configuration files that may be targeted by XXE attacks
• Monitor outbound network traffic from SAML processing servers for anomalous connections
• Set up alerts for authentication service errors related to XML parsing

How to Mitigate CVE-2024-52806

Immediate Actions Required

• Update SimpleSAMLphp SAML2 library to version 4.6.14 or later immediately
• For users on the alpha branch, upgrade to version 5.0.0-alpha.18 or later
• Audit all applications using SimpleSAMLphp SAML2 library to identify vulnerable instances
• Review access logs for any indicators of prior exploitation attempts

Patch Information

The vulnerability has been fixed in SimpleSAMLphp SAML2 library versions 4.6.14 and 5.0.0-alpha.18. The security patch properly disables external entity processing when loading XML documents. The fix can be reviewed in the GitHub commit reference. Additional details are available in the GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, implement network-level controls to restrict access to SAML endpoints
• Configure web application firewalls to filter XML payloads containing DOCTYPE or ENTITY declarations
• Isolate SAML processing components from sensitive internal resources to limit the impact of potential exploitation
• Consider implementing additional input validation at the application layer to reject suspicious XML content

# Composer update command to patch the vulnerability
composer require simplesamlphp/saml2:^4.6.14

# For alpha branch users
composer require simplesamlphp/saml2:^5.0.0-alpha.18