=====================================================================

                                   CERT-Renater

                        Note d'Information No. 2022/VULN406

_____________________________________________________________________

DATE                : 02/11/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running phpcas versions prior to 1.6.0.

=====================================================================
https://github.com/advisories/GHSA-8q72-6qq8-xv64
_____________________________________________________________________

Service Hostname Discovery Exploitation
High	jfritschi published GHSA-8q72-6qq8-xv64

Package
  apereo/phpcas (Composer)

Affected versions
< 1.6.0

Patched versions
1.6.0


Description

Impact
The phpCAS library uses HTTP headers to determine the service URL
used to validate tickets. This allows an attacker to control the
host header and use a valid ticket granted for any authorized
service in the same SSO realm (CAS server) to authenticate to the
service protected by phpCAS.

Depending on the settings of the CAS server service registry in
worst case this may be any other service URL (if the allowed URLs
are configured to "^(https)://.*") or may be strictly limited to
known and authorized services in the same SSO federation if proper
URL service validation is applied.


This vulnerability may allow an attacker to gain access to a
victim's account on a vulnerable CASified service without victim's
knowledge, when the victim visits attacker's website while being
logged in to the same CAS server.

Patch
phpCAS 1.6.0 is a major version upgrade that starts enforcing
service URL discovery validation, because there is unfortunately
no 100% safe default config to use in PHP. Starting this version,
it is required to pass in an additional service base URL argument
when constructing the client class.

For more information, please refer to the upgrading doc.


Workarounds
This vulnerability only impacts the CAS client that the phpCAS
library protects against. The problematic service URL discovery
behavior in phpCAS < 1.6.0 will only be disabled, and thus you
are not impacted from it, if the phpCAS configuration has the
following setup:

phpCAS::setUrl() is called (a reminder that you have to pass in
the full URL of the current page, rather than your service base
URL), and
phpCAS::setCallbackURL() is called, only when the proxy mode is
enabled.
Alternatively, if your PHP's HTTP header input X-Forwarded-Host,
X-Forwarded-Server, Host, X-Forwarded-Proto, X-Forwarded-Protocol
is sanitized before reaching PHP (by a reverse proxy, for example),
  you will not be impacted by this vulnerability.

Otherwise, you should upgrade the library to get the safe service
discovery behavior.

If your CAS server service registry is configured to only allow
known and trusted service URLs, the severity of the vulnerability
is reduced substantially since an attacker must be in control of
another authorized service.


Acknowledgement
We would like to thank Filip Hejsek for discovering this
vulnerability, responsibly reporting it to the developers, and
helping harden the patch.

Henry Pan and Joachim Fritschi helped with the patch and release
effort as phpCAS developers.


Severity

High

8.0/ 10


CVSS base metrics

Attack vector
Network

Attack complexity
Low

Privileges required
Low

User interaction
Required

Scope
Unchanged

Confidentiality
High

Integrity
High

Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CVE ID
CVE-2022-39369

Weaknesses
CWE-99 CWE-1287


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================