CVE-2025-27773
HIGH
Published 2025-03-11T19:04:52.135Z
Actions:
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2025-27773. We'll provide specific mitigation strategies based on your environment and risk profile.
CVSS Score
V3.1
8.6
/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Base Score Metrics
Exploitability: N/A
Impact: N/A
EPSS Score
v2025.03.14
0.000
probability
of exploitation in the wild
There is a 0.0% chance that this vulnerability will be exploited in the wild within the next 30 days.
Updated: 2025-06-25
Exploit Probability
Percentile: 0.115
Higher than 11.5% of all CVEs
Attack Vector Metrics
Impact Metrics
Description
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.
Available Exploits
No exploits available for this CVE.
Related News
No news articles found for this CVE.
Affected Products
Affected Versions:
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
✓ GitHub Reviewed
HIGH
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
GHSA-46r4-f8gj-xg56Advisory Details
### Summary
There's a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message.
I believe that it exists for v4 only. I have not yet developed a PoC.
V5 is well designed and instead builds the signed query from the same message that will be consumed.
### Details
#### What is verified
The data['SignedQuery'] is the string that will be verified by the public key.
It is defined here:
https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L178-L217
THe code will iterate through each parameter name. Notably, sigQuery is overridden each time when processing, making the last of SAMLRequest/SAMLResponse used for sigQuery.
For example, given:
SAMLRequest=a&SAMLResponse=idpsigned
SAMLResponse=idpsigned will be set as sigQuery, then later verified
#### What is actually processed
Processing uses SAMLRequest parameter value first, (if it exists) then SAMLResponse:
https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L104-L113
Given this, the contents that are processed might not be the same as the data that is actually verified.
### Exploiting
Suppose an attacker has a signed HTTP Redirect binding from IdP, say a signed logout response. :
SAMLResponse=idpsigned&RelayState=...&SigAlg=...&Signature
Then an attacker can append SAMLRequest in front:
`SAMLRequest=unverifieddata&SAMLResponse=idpsigned&RelayState=...&SigAlg=...&Signature=..`
SimpleSAMLPhp will only verify the SAMLResponse, but will actually use the SAMLRequest contents. The impact here is increased because there's no checks that SAMLRequest actually contains a Request, it could instead contain an Response, which allows the attacker to effectively impersonate any user within the SP.
### IdPs
Microsoft Azure AD/Entra (and likely ADFS) signs the LogoutResponse via this SimpleSign format in HTTP Redirect binding. If an attacker logs out of Entra, they will be able to extract a valid Signature.
Attached is an HTTP Request when an I initiated a SLO request from the service provider to the IdP (entra). Then IdP POSTed this SAMLResponse with HTTP Redirect binding signature, via the user browser to the SP. It should be possible to carry out the described attack with this.
```
https://webhook.site/c6038292-6ef5-46ac-973d-d7c25520ec48/logout?SAMLResponse=fVJNa%2bMwEP0rRndZtmw5tnAMy%2fYSaC9N6aGXIsmjVMTRGI9M%2bvObdeihsPQ4w7x5HzM9mcs060c84ZqegWaMBNnhYc%2fejS1UW1TAnVU7XldK8s7JkcvOd60Db3zTsewVFgoY90zmBcsORCscIiUT061VyJqXJS%2fbl7LRUmrZ5mXdvLHsASiFaNKG%2fEhpJi3EFewH4jmnkEC4pqha2UnegFe8bozj3a4a%2bbhzUilZgKtbMW2yb7TxW%2foL7lkM9hTC2XnEOPvZXjDECb2N1lh7mvBsp%2bnsErDs8zJF0lsEe7YuUaOhQDqaC5BOTh%2f%2fPD3qmzE9L5jQ4cSGfrO43KG%2fgwwRLP8ssuHbIiXKryGOeKU8QhLSVN7WteejV8Bru%2bt4WynFbwE3bdVV5ahG0Ys759Dfj3VMJq30s%2fqLI2SvZlrhd020Tevj6hwQMTH04udS8b%2bHGL4A&Signature=Z%2f7gIPv7Gkgvqtwo0bzgXyum9IjHMfP0zTYuNbl%2fBUGlQ%2fU%2bbOZGZJ6Rk9wLUyvNQ5XlZRxZrfESNA%2bn0CVyIedsg9GxQKTi7VqPTJFJqEIP1BZaEpYYP3%2f6sFfLxfTMKecJoQdxnDE5Malte1hMj2UujWnLXOnp0CgO%2f%2fU2K52SoGckIzNDRB%2fJ6%2fysTn%2bDjBrmgdro%2fgdTyby9%2f3vm8dzY8pUkRCgMjlimShrZxr5U33wQvwPLIXlDgActr91RUtWKE0k8sy%2brshrK9DKLPo8AdTLk7NYhjSWdF7OG7uqgEeEo470tacqQuA09E0qDh8CWS%2bycLJijiGYWVyQa4Q%3d%3d&SigAlg=http%3a%2f%2fwww.w3.org%2f2001%2f04%2fxmldsig-more%23rsa-sha256
```
Affected Packages
Packagist
simplesamlphp/saml2
ECOSYSTEM:
≥0
<4.17.0
Packagist
simplesamlphp/saml2
ECOSYSTEM:
≥5.0.0-alpha.1
<5.0.0-alpha.20
Packagist
simplesamlphp/saml2-legacy
ECOSYSTEM:
≥0
<4.17.0
CVSS Scoring
CVSS Score
7.5
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
References
Advisory provided by GitHub Security Advisory Database. Published: March 11, 2025, Modified: May 9, 2025
Social Media Intelligence
Real-time discussions and threat intelligence from social platforms
Reddit
•
5 days, 18 hours ago
michaelpaoli
Debian 13.1 (and 12.12) 2025-09-06 "Just" a "minor" point release. But for those that have been waiting to upgrade to Debian 13, perhaps that time now draws nearer? [\[SUA 273-1\] Upcoming Debian 13 Update (13.1)](https://lists.debian.org/debian-stable-announce/2025/09/msg00000.html) [\[SUA 274-1\] Upcoming Debian 12 Update (12.12)](https://lists.debian.org/debian-stable-announce/2025/09/msg00001.html) 13.1: >\[SUA 273-1\] Upcoming Debian 13 Update (13.1) …
Also mentions:
CVE-2025-7039
CVE-2025-40927
CVE-2025-9185
CVE-2025-9181
CVE-2025-47806
CVE-2025-47219
CVE-2025-47807
CVE-2025-47808
CVE-2025-53859
CVE-2025-50952
CVE-2025-54798
CVE-2025-54874
CVE-2025-54350
CVE-2025-54349
CVE-2025-27613
CVE-2025-27614
CVE-2025-20260
CVE-2025-23048
CVE-2025-46835
CVE-2025-49812
CVE-2025-49630
CVE-2025-53019
CVE-2025-53101
CVE-2025-53020
CVE-2025-8058
CVE-2024-42516
CVE-2024-43394
CVE-2024-43204
CVE-2024-47252
CVE-2025-6965
CVE-2025-7394
CVE-2025-7783
CVE-2025-53015
CVE-2025-53014
CVE-2025-48385
CVE-2025-48384
CVE-2024-25178
CVE-2024-25177
CVE-2024-25176
CVE-2025-4748
CVE-2024-6174
CVE-2024-11584
CVE-2025-6170
CVE-2025-49794
CVE-2025-49796
CVE-2025-6021
CVE-2025-5916
CVE-2025-5915
CVE-2025-5914
CVE-2025-5917
CVE-2025-49133
CVE-2025-48387
CVE-2025-27553
CVE-2025-48734
CVE-2025-46712
CVE-2025-46393
CVE-2025-46398
CVE-2025-46397
CVE-2025-47203
CVE-2023-52970
CVE-2023-26819
CVE-2025-40908
CVE-2025-40909
CVE-2025-4373
CVE-2023-53154
CVE-2025-2784
CVE-2025-48060
CVE-2025-47273
CVE-2025-4802
CVE-2025-46399
CVE-2025-46400
CVE-2025-46337
CVE-2025-32050
CVE-2025-46421
CVE-2025-46420
CVE-2025-43965
CVE-2025-43964
CVE-2025-43963
CVE-2025-43962
CVE-2025-43961
CVE-2025-3818
CVE-2025-32906
CVE-2025-32912
CVE-2025-32911
CVE-2025-30722
CVE-2025-30693
CVE-2025-3576
CVE-2025-32910
CVE-2025-32909
CVE-2025-32913
CVE-2025-32053
CVE-2025-32052
CVE-2025-32051
CVE-2024-12905
CVE-2025-30472
CVE-2024-6866
CVE-2024-6844
CVE-2024-6839
CVE-2024-8176
CVE-2023-52971
CVE-2023-52969
CVE-2025-27516
CVE-2025-27221
CVE-2022-37660
CVE-2024-56161
CVE-2025-20128
CVE-2025-23016
CVE-2024-34703
CVE-2024-34702
CVE-2024-45236
CVE-2024-45234
CVE-2024-45235
CVE-2024-45238
CVE-2024-45237
CVE-2024-45239
CVE-2024-0962
CVE-2024-10525
CVE-2024-31031
CVE-2024-38875
CVE-2024-57822
CVE-2024-57823
CVE-2024-3935
CVE-2024-42005
CVE-2024-39330
CVE-2024-39329
CVE-2024-39917
CVE-2024-39312
CVE-2024-39614
CVE-2024-52532
CVE-2024-52530
CVE-2024-52531
CVE-2024-33899
CVE-2024-50602
CVE-2024-50624
CVE-2024-50383
CVE-2024-50612
CVE-2024-5569
CVE-2024-49768
CVE-2024-49769
CVE-2024-1681
CVE-2024-41991
CVE-2024-41990
CVE-2024-41989
CVE-2024-8376
CVE-2023-36053
CVE-2023-31484
CVE-2023-28755
CVE-2023-28366
CVE-2023-42822
CVE-2023-52425
CVE-2023-40184
CVE-2022-33065
CVE-2021-46312
CVE-2021-46310
CVE-2021-25743
CVE-2019-25211
70
8
86.0
References
Published: 2025-03-11T19:04:52.135Z
Last Modified: 2025-05-09T20:03:38.107Z
Copied to clipboard!