GHSA-fjr2-r2mp-484p: 
PHP vulnerability analysis and mitigation

A critical signature validation bypass vulnerability was discovered in SimpleSAMLphp versions up to 1.14.16, identified as CVE-2017-18122. The vulnerability was discovered on October 22, 2017, and publicly disclosed on October 25, 2017. This security flaw affects the SimpleSAML_XML_Validator class, which is responsible for verifying XML digital signatures in SAML 1 messages (SimpleSAMLphp Advisory).

The vulnerability stems from a lax comparison in the isNodeValidated() method of the SimpleSAML_XML_Validator class. The method uses PHP's in_array() function without strict type checking to verify if DOM nodes are in the validNodes array. Due to PHP's default loose type comparison behavior, the presence of any DOM node in the list causes the function to return true for any DOM node being checked, effectively bypassing the signature validation process (GitHub Advisory).

The vulnerability allows attackers to impersonate any user from any SAML 1 Identity Provider trusted by a SimpleSAMLphp Service Provider. The only prerequisite is having access to a valid assertion previously sent to the affected Service Provider. The impact is particularly severe for SimpleSAMLphp installations with metadata deployed for SAML 1 Identity Providers, typically listed in the metadata/shib13-idp-remote.php file (SimpleSAMLphp Advisory).

An attacker can exploit this vulnerability by generating a SAML 1 authentication response containing two assertions: a tampered assertion with custom attributes and a legitimate signed assertion from a trusted Identity Provider. If the legitimate assertion is valid, the system merges attributes from both assertions, using the entityID from the tampered assertion. If the legitimate assertion is expired, only the tampered assertion's attributes are used (GitHub Advisory).

The recommended mitigation is to upgrade to SimpleSAMLphp version 1.14.17 or later. For cases where immediate upgrade isn't possible, a patch is available that modifies the in_array() function call in the SimpleSAML_XML_Validator class to use strict comparisons by adding a third parameter 'true' (SimpleSAMLphp Advisory).