Shibboleth Service Provider Security Advisory [22 June 2021]

[Cantor, Scott]

 -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


Shibboleth Service Provider Security Advisory [22 June 2021]

An updated version of the Service Provider software is now
available which corrects a critical header smuggling/spoofing
vulnerability on Windows when using IIS.

Header smuggling allows for impersonation under IIS 7+
======================================================================
The Service Provider module for Microsoft's IIS 7 and above includes
support for both header-based and server variable-based export of user
attribute data into the application environment.

Unfortunately the server variable support was implemented incorrectly,
and is vulnerable to header smuggling or spoofing attacks. The usual
logic that attempts to detect and block this is not active when the
<ISAPI> element's useHeaders option is unset or false in the SP
configuration, which is the default for new installs.

Under these conditions, an attacker can easily supply values that the
SP will append its own data to when it exports attribute information
into the environment and the application will see both the fake and
the legitimate values, allowing for subversion of access control
rules and potentially impersonation of users.

This issue does not impact the use of Apache or any other non-IIS
environment, and does not impact the older, deprecated IIS filter,
which only supported headers and does not honor the options involved.


Recommendations
===============
Update to V3.2.2.2 or later of the Service Provider software, which
is now available. This a Windows-only update to the V3.2.2 release
containing the fixed IIS module.

In cases where this is not immediately possible, adding
useHeaders="true" to the <ISAPI> element in shibboleth2.xml will
enable the usual header detection code that attempts to prevent
header smuggling. In most cases, this should not impact applications
that are accessing data via server variables.

This workaround is only possible after having updated the core
configuration to the V3 XML namespace.

Example:
<ISAPI useHeaders="true" useVariables="true">

Note that while systems using the older filter are not affected,
that filter is deprecated, and all deployers should upgrade to ensure
that if a future change enables the newer module that the system does
not remain vulnerable.

Credits
=======
Thanks to Klintra/Faroese Telecom for discovering and reporting this
vulnerability.


URL for this Security Advisory:
https://shibboleth.net/community/advisories/secadv_20210622.txt

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3KoVAHvtneaQzZUjN4uEVAIneWIFAmDR2MYACgkQN4uEVAIn
eWLg9A//cG4Hc0GyvAlK8kFABHAtSlY4R7FlBqX96tmxsV0raSLR+ARaZdVgD0K7
RtllZBk2VErw/iommmq1OsOfpKHcTxpT7pPlaMlDYpYACRwPKJi1cCOeQHxVzU3q
F87xJiP1u4ajuqSD6277YWRjtjg19R56Clc++N4s882Mva0ztVz6sGgws9xVak0D
VZ9MdRj6nxmY3b6tRUqpTCe5dPYlu7o8CRzA0xqQ2omQQnqg9EMnX5jK+79Yqyhp
nSXDnRPy4X7hu73Pwg3mPeaylWydNDevkBxM6An8xBSmpTeWWPbCbXYXO0dnSJIa
BdMB6RF1nKRXrttVoX5a4ur9Tagw1mcPgffNzXp5dsfVw/kCvy4vkSNC8LnhIVwE
9e/aZtwX5rpXmOzGB2LrA3eQYZ27pRQbE2/vq956P9G633mUJUHP0yKgiP6mWzPY
nS0rsS95Yw00mKQMfikdku+glW4/047dWbpJAs7+8NpiWhqo+kOaBHGr0ZrYDtKe
ANJ72DPM1hUhukKhQm8en1uExmdvsx43r7R3CMA48Ib0feciKsyWdExZX2p/zKdi
rPZKwugwKEh3Ua/DKcWuSVWFUB0GlnNfICyai6g2iRzH2sbREr7Mxsh27Fhtd9eo
gEvbbdJNNuM4Yv/LzjK6L1Q+66OmZza9u3shlwghJU1u/Z3N3eQ=
=ywKY
-----END PGP SIGNATURE-----