CVE-2021-28963: 
Shibboleth Service Provider vulnerability analysis and mitigation

CVE-2021-28963 affects Shibboleth Service Provider versions before 3.2.1. The vulnerability was discovered by Toni Huttunen from Fraktal Oy and disclosed on March 17, 2021. The issue allows content injection because template generation uses attacker-controlled parameters (Shibboleth Advisory, NVD).

The vulnerability exists in the primitive template engine used by Shibboleth SP to render error pages and various status/transition pages. The engine supports embedding placeholders that are replaced by internally supplied values or configuration settings. The system was extended to allow replacement via query parameters, enabling attackers to manipulate template content through URL manipulation. While values are encoded to prevent script injection, the content appears to come from the server and would be interpreted as trustworthy. The vulnerability has a CVSS v3.1 Base Score of 5.3 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability allows attackers to manipulate trusted content displayed to users, including email addresses, logos, style sheets, and support URLs. Since the injected content appears to come from the legitimate server, it could be used in phishing attacks by presenting users with malicious but seemingly trustworthy information (Shibboleth Advisory).

The vulnerability can be exploited remotely through URL manipulation of template parameters. No authentication is required to exploit this vulnerability, making it relatively easy to exploit (NVD).

The primary mitigation is to upgrade to Shibboleth Service Provider version 3.2.1 or later. The update adds a new configuration setting called 'externalParameters' which defaults to false, disabling the vulnerable feature. For systems that cannot be immediately updated, reducing or eliminating sensitive template replacement values with static values in the templates may decrease the impact (Shibboleth Advisory).