CVE-2020-5301: 
PHP vulnerability analysis and mitigation

SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability identified as CVE-2020-5301. The vulnerability was discovered by Sławek Naczyński and disclosed in April 2020. The issue affects the module controller in SimpleSAML\Module that processes requests for pages hosted by modules (GitHub Advisory).

The vulnerability stems from improper handling of case sensitivity in file extensions. The module controller checks for paths ending with '.php' to process them as PHP code, but this check doesn't account for uppercase letters. When a path ends with uppercase extensions (e.g., '.PHP') and the server is running on a case-insensitive file system like Windows, the PHP code processing is bypassed, resulting in the source code being displayed in the browser instead of being executed (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 3.1 (LOW) with vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

An attacker could potentially gain unauthorized access to source code in third-party modules that is intended to be private or contains sensitive information. However, the attack surface is considered small since the vulnerability only affects SimpleSAMLphp installations running on case-insensitive file systems, such as Windows (GitHub Advisory).

The vulnerability requires specific conditions to be exploited: the SimpleSAMLphp installation must be running on a case-insensitive file system (like Windows), and the attacker needs to specifically request paths with uppercase PHP extensions. The attack complexity is considered high, requiring low privileges and no user interaction (NVD).

The vulnerability has been fixed in SimpleSAMLphp version 1.18.6. The fix involves converting the path to lowercase before checking the file extension. Organizations using affected versions should upgrade to version 1.18.6 or later to address this security issue (GitHub Commit).