GHSA-9wrw-p9rm-r782: 
PHP vulnerability analysis and mitigation

A security vulnerability was identified in onelogin/php-saml library affecting versions prior to 2.10.4, where improper signature validation occurred on LogoutRequest and LogoutResponse components. The issue was discovered and disclosed on February 28, 2017, impacting the signature verification mechanism of the SAML toolkit (GitHub Advisory).

The vulnerability stems from the way signature verification was implemented using the verifySignature method of XMLSecurityKey class from the xmlseclibs library. The issue occurs when the openssl_verify() function, which returns 1 for successful verification, 0 for failed verification, and -1 for errors, is implicitly converted to boolean in PHP. Due to PHP's implicit conversion rules, where any non-zero value (including -1) is converted to true, an error state during signature verification would be incorrectly interpreted as a successful verification (GitHub Advisory).

The vulnerability's impact was considered low severity as it only affected the signature validation of LogoutRequest and LogoutResponse components, while the critical SAMLResponses signature validation remained unaffected. However, the flaw could potentially allow an attacker to bypass signature verification when an error occurs during the verification process (GitHub Advisory).

The vulnerability could be exploited in scenarios where signature verification errors occur during LogoutRequest or LogoutResponse processing, as these errors would be incorrectly interpreted as successful validations (GitHub Advisory).

The vulnerability was patched in version 2.10.4 of the php-saml toolkit. The fix involved modifying the signature validation logic to explicitly check for a return value of 1 from the verification process, rather than relying on implicit boolean conversion (SAML Commit).