CVE-2024-52596

What it actually does

Allows external entity expansion when parsing untrusted XML documents such as SAMLResponse, enabling local file disclosure or limited server-side request forgery.

Why it matters to the business

Attackers could read sensitive configuration or credential files from identity provider systems or cause denial-of-service, increasing risk of data exposure in authentication workflows.

How an attack unfolds

An attacker supplies a crafted SAMLResponse containing malicious XML entity declarations to a SimpleSAMLphp endpoint; the vulnerable parser resolves external entities and returns or processes the resulting content.

How to fix it

Upgrade SimpleSAMLphp xml-common to version 1.19.0 or later; disable external entity resolution in XML parsers until patches are applied.

How to confirm the fix worked

Verify the installed version is at least 1.19.0; retest XML parsing endpoints with benign XXE test vectors to confirm entity expansion is blocked.

Typical attack path

1. Locate an endpoint that accepts SAML assertions or other XML input
2. Embed XXE payload referencing local files or internal resources inside the XML document
3. Submit the malicious payload via HTTP POST or other accepted method
4. Observe response or side-channel for exfiltrated data or error conditions

How to detect it

Inspect web server and application logs for XML documents containing DOCTYPE declarations with SYSTEM or PUBLIC entities; correlate with file access attempts to sensitive paths.

What your security team should do

• Apply the 1.19.0 update across all SimpleSAMLphp deployments immediately
• Review and harden XML parser configurations to disable external entities by default
• Monitor authentication endpoints for unusual XML structures or error patterns
• Audit logs for evidence of prior exploitation attempts