CVE Vulnerabilities

CVE-2022-39369

Improper Control of Resource Identifiers ('Resource Injection')

Published: Nov 01, 2022 | Modified: Nov 21, 2024
CVSS 3.x
8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a valid ticket granted for any authorized service in the same SSO realm (CAS server) to authenticate to the service protected by phpCAS. Depending on the settings of the CAS server service registry in worst case this may be any other service URL (if the allowed URLs are configured to ^(https)://.*) or may be strictly limited to known and authorized services in the same SSO federation if proper URL service validation is applied. This vulnerability may allow an attacker to gain access to a victims account on a vulnerable CASified service without victims knowledge, when the victim visits attackers website while being logged in to the same CAS server. phpCAS 1.6.0 is a major version upgrade that starts enforcing service URL discovery validation, because there is unfortunately no 100% safe default config to use in PHP. Starting this version, it is required to pass in an additional service base URL argument when constructing the client class. For more information, please refer to the upgrading doc. This vulnerability only impacts the CAS client that the phpCAS library protects against. The problematic service URL discovery behavior in phpCAS < 1.6.0 will only be disabled, and thus you are not impacted from it, if the phpCAS configuration has the following setup: 1. phpCAS::setUrl() is called (a reminder that you have to pass in the full URL of the current page, rather than your service base URL), and 2. phpCAS::setCallbackURL() is called, only when the proxy mode is enabled. 3. If your PHPs HTTP header input X-Forwarded-Host, X-Forwarded-Server, Host, X-Forwarded-Proto, X-Forwarded-Protocol is sanitized before reaching PHP (by a reverse proxy, for example), you will not be impacted by this vulnerability either. If your CAS server service registry is configured to only allow known and trusted service URLs the severity of the vulnerability is reduced substantially in its severity since an attacker must be in control of another authorized service. Otherwise, you should upgrade the library to get the safe service discovery behavior.

Weakness

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

Affected Software

Name Vendor Start Version End Version
Phpcas Apereo * 1.6.0 (excluding)
Moodle Ubuntu bionic *
Moodle Ubuntu esm-apps/bionic *
Moodle Ubuntu esm-apps/xenial *
Moodle Ubuntu upstream *
Moodle Ubuntu xenial *
Ocsinventory-server Ubuntu bionic *
Ocsinventory-server Ubuntu esm-apps/xenial *
Ocsinventory-server Ubuntu jammy *
Ocsinventory-server Ubuntu upstream *
Ocsinventory-server Ubuntu xenial *
Php-cas Ubuntu bionic *
Php-cas Ubuntu esm-apps/bionic *
Php-cas Ubuntu esm-apps/xenial *
Php-cas Ubuntu focal *
Php-cas Ubuntu jammy *
Php-cas Ubuntu kinetic *
Php-cas Ubuntu trusty *
Php-cas Ubuntu upstream *
Php-cas Ubuntu xenial *

Extended Description

A resource injection issue occurs when the following two conditions are met:

This may enable an attacker to access or modify otherwise protected system resources.

Potential Mitigations

  • Assume all input is malicious. Use an “accept known good” input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, “boat” may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as “red” or “blue.”
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code’s environment changes. This can give attackers enough room to bypass the intended validation. However, it can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

References