Cloudanix VulnDB

CVE-2024-52806

High · 8.3

CVSS

8.3

EPSS

0.4%

Published

Dec 2, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in a widely used login system component could allow attackers to read private files on the server by sending specially crafted login messages.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Library
Class
XXE
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits XML External Entity (XXE) injection during parsing of untrusted XML documents such as SAMLResponse objects, allowing local file disclosure or server-side request forgery through entity expansion.

Why it matters to the business

Attackers may read sensitive server files or interact with internal systems, increasing risk of credential theft, lateral movement, or disruption of identity federation services used for authentication.

How an attack unfolds

An attacker crafts a SAMLResponse containing a malicious XML document with external entity declarations and submits it to a SAML endpoint. The library parses the XML without proper entity restrictions, resolving the external references to read local files or issue outbound requests.

How to fix it

Upgrade simplesamlphp/saml2 to version 4.6.14, 5.0.0-alpha.18, or apply commit 6fc78c90cd13c2d11907f077b313b2cd606a744d; disable external entity resolution in XML parsers as a temporary control.

How to confirm the fix worked

Confirm the deployed library version matches a fixed release; test endpoints with known XXE test vectors and verify that external entity resolution is rejected.

Typical attack path

  1. Identify a SAML endpoint accepting untrusted XML
  2. Craft XML payload containing DOCTYPE and ENTITY declarations referencing local files or internal URLs
  3. Submit the payload as SAMLResponse
  4. Observe or exfiltrate data returned through entity expansion

How to detect it

Inspect web server and application logs for SAMLResponse values containing DOCTYPE or ENTITY declarations; monitor for unexpected file reads or outbound connections originating from the SAML processing code.

  • DOCTYPE
  • ENTITY%20
  • SYSTEM%20"file:
  • SYSTEM%20"http:
  • SAMLResponse.*<!ENTITY

What your security team should do

  • Immediately upgrade the saml2 library to a fixed version
  • Audit all SAML endpoints for unsafe XML parser configurations
  • Implement WAF rules to block XML containing DOCTYPE declarations on SAML paths
  • Review logs for prior XXE attempts and rotate any potentially exposed secrets

The record

SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.

Affected packages

Ecosystem Package Introduced Fixed
Packagist simplesamlphp/saml2 0 4.6.14
Packagist simplesamlphp/saml2-legacy 0 4.6.14
Debian:11 simplesamlphp 0 1.19.0-1+deb11u1
Debian:12 simplesamlphp 0 1.19.7-1+deb12u1
Ubuntu:16.04:LTS simplesamlphp 0 No fix
Ubuntu:18.04:LTS simplesamlphp 0 No fix
Ubuntu:20.04:LTS simplesamlphp 0 No fix
Ubuntu:22.04:LTS simplesamlphp 0 No fix
Ubuntu:24.04:LTS simplesamlphp 0 No fix
Ubuntu:24.10 simplesamlphp 0 No fix
Ubuntu:25.04 simplesamlphp 0 No fix
Ubuntu:25.10 simplesamlphp 0 No fix
Ubuntu:Pro:16.04:LTS simplesamlphp 0 No fix
Ubuntu:Pro:18.04:LTS simplesamlphp 0 No fix
Ubuntu:Pro:20.04:LTS simplesamlphp 0 No fix

Related vulnerabilities