{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/simplesamlphp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.3,"id":"CVE-2024-52806"},{"id":"CVE-2024-52596"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SimpleSAMLphp","Saml2 Library"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","xxe","authentication"],"_cs_type":"advisory","_cs_vendors":["SimpleSAMLphp"],"content_html":"\u003cp\u003eSimpleSAMLphp and the associated Saml2 Library have been identified as vulnerable to a pre-authentication XML External Entity (XXE) injection vulnerability, tracked as CVE-2024-52806 and CVE-2024-52596. This critical flaw permits an unauthenticated remote attacker to send maliciously crafted XML payloads to the application, which the parser processes to read arbitrary files from the underlying server filesystem.\u003c/p\u003e\n\u003cp\u003eThe vulnerability carries a CVSS score of 8.8, reflecting the ease of exploitation (low attack complexity, no authentication, no user interaction required). The availability of a functional Python-based proof-of-concept exploit, published on August 12, 2026, significantly increases the risk of exploitation for organizations running unpatched versions of the SimpleSAMLphp framework or utilizing the affected Saml2 Library components. Defenders should prioritize patching or implementing protective measures to prevent unauthorized access to sensitive configuration and credential files typically stored on these servers.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized disclosure of sensitive server-side files, which may contain environment variables, encryption keys, application source code, or internal authentication credentials. This information disclosure can serve as a precursor to further system compromise, lateral movement, or full application takeover. All sectors utilizing SimpleSAMLphp for SAML identity federation are potentially exposed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit web server logs for HTTP requests containing XML payloads targeting SimpleSAMLphp endpoints.\u003c/li\u003e\n\u003cli\u003eUpdate SimpleSAMLphp and the Saml2 Library to the latest patched versions provided by the vendor to remediate CVE-2024-52806 and CVE-2024-52596.\u003c/li\u003e\n\u003cli\u003eImplement Web Application Firewall (WAF) rules to detect and block incoming POST requests containing prohibited XML external entity definitions (e.g., \u0026lt;!ENTITY, SYSTEM, PUBLIC).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-12T13:20:35Z","date_published":"2026-08-12T13:20:35Z","id":"https://feed.craftedsignal.io/briefs/2026-08-simplesamlphp-xxe/","summary":"A proof-of-concept exploit has been published for a pre-authentication XML External Entity (XXE) vulnerability in SimpleSAMLphp and the Saml2 Library, enabling arbitrary file read by unauthenticated remote attackers.","title":"Pre-Authentication XXE Vulnerability in SimpleSAMLphp","url":"https://feed.craftedsignal.io/briefs/2026-08-simplesamlphp-xxe/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["simplesamlphp/simplesamlphp-module-casserver \u003c= 7.0.2"],"_cs_severities":["high"],"_cs_tags":["path-traversal","file-deletion","simplesamlphp"],"_cs_type":"advisory","_cs_vendors":["composer"],"content_html":"\u003cp\u003eA path traversal vulnerability exists within the \u003ccode\u003esimplesamlphp-module-casserver\u003c/code\u003e module, specifically affecting deployments that utilize the \u003ccode\u003eFileSystemTicketStore\u003c/code\u003e. This vulnerability, identified as CVE-2026-46491, arises from the direct concatenation of the configured ticket directory with attacker-controlled ticket identifiers received via the \u003ccode\u003eticket\u003c/code\u003e or \u003ccode\u003epgt\u003c/code\u003e query parameters in public CAS validation/proxy endpoints. By injecting path traversal sequences (e.g., \u003ccode\u003e../target.serialized\u003c/code\u003e) into these parameters, attackers can read and unserialize arbitrary files outside the designated ticket directory. Furthermore, the CAS 1.0 validation flow can lead to the deletion of attacker-specified files if the PHP process has sufficient permissions and the file contents can be unserialized into a compatible type. This issue impacts versions of \u003ccode\u003ecomposer/simplesamlphp/simplesamlphp-module-casserver\u003c/code\u003e up to and including 7.0.2.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a SimpleSAMLphp instance with the casserver module enabled and configured to use FileSystemTicketStore.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious CAS validation/proxy request containing a \u003ccode\u003eticket\u003c/code\u003e or \u003ccode\u003epgt\u003c/code\u003e parameter with a path traversal sequence (e.g., \u003ccode\u003e../target.serialized\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe SimpleSAMLphp application receives the request and concatenates the attacker-controlled \u003ccode\u003eticket\u003c/code\u003e parameter with the configured ticket directory.\u003c/li\u003e\n\u003cli\u003eThe application attempts to read the file at the constructed path using \u003ccode\u003egetTicket()\u003c/code\u003e. Due to the path traversal, the file accessed is outside the intended ticket directory.\u003c/li\u003e\n\u003cli\u003eIf the file contains valid serialized PHP data, the application unserializes its content.\u003c/li\u003e\n\u003cli\u003eIn the CAS 1.0 validation flow, the application calls \u003ccode\u003edeleteTicket()\u003c/code\u003e with the same attacker-controlled path.\u003c/li\u003e\n\u003cli\u003eIf the PHP process has sufficient permissions and the unserialized content meets certain criteria (e.g., an array or null), the target file is deleted.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves unauthorized file read and potentially deletion, impacting system integrity and confidentiality.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability (CVE-2026-46491) allows remote attackers to bypass intended file access restrictions. Confirmed impacts include the ability to read and unserialize arbitrary files outside the designated ticket cache, potentially exposing sensitive data. Furthermore, under specific conditions within the CAS 1.0 validation flow, attackers can delete files outside the ticket cache, leading to denial-of-service or data loss scenarios. The severity of file deletion depends on the filesystem permissions of the PHP process and the content of the targeted file. This could potentially lead to destruction of CAS tickets, serialized SimpleSAMLphp runtime/cache files, or other writable files whose contents can be unserialized into a value accepted by the \u003ccode\u003e?array\u003c/code\u003e return type.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003ecomposer/simplesamlphp/simplesamlphp-module-casserver\u003c/code\u003e package to a version greater than 7.0.2 to remediate CVE-2026-46491.\u003c/li\u003e\n\u003cli\u003eImplement input validation and sanitization on the \u003ccode\u003eticket\u003c/code\u003e and \u003ccode\u003epgt\u003c/code\u003e parameters to prevent path traversal attacks.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect SimpleSAMLphp FileSystemTicketStore Path Traversal Attempt\u0026quot; to identify potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eReview and restrict the filesystem permissions of the PHP process to minimize the impact of potential file deletion.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-15T18:10:59Z","date_published":"2026-05-15T18:10:59Z","id":"https://feed.craftedsignal.io/briefs/2026-05-simplesamlphp-traversal/","summary":"A path traversal vulnerability in SimpleSAMLphp's casserver module allows remote attackers to read and potentially delete arbitrary files outside the ticket directory by manipulating the ticket parameter in CAS validation requests, impacting confidentiality and integrity.","title":"SimpleSAMLphp casserver FileSystemTicketStore Path Traversal Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-05-simplesamlphp-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - SimpleSAMLphp","version":"https://jsonfeed.org/version/1.1"}