Shibboleth Identity Provider Security Advisory [30 March 2023]

[Cantor, Scott]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Shibboleth Identity Provider Security Advisory [30 March 2023]

Regression in RemoteUser login flow could lead to impersonation
===============================================================
A regression was introduced into the RemoteUser login flow in
the Shibboleth Identity Provider software allowing the use of
a fixed header name to supply the REMOTE_USER value to use.
In the absence of an actual REMOTE_USER variable or any
configured servlet request attributes, the code would fall back
to using a "fixed" header variable name instead of honoring the
configured set of headers to look at.

Given that this would be immediately obvious while using the
software (since it would be unable to obtain a value to use and fail),
it is unlikely this would escape notice, but there is the theoretical
chance of an unguarded header being accepted as the identity.

Deployments that do not make use of this login flow are unaffected
(despite the fact that the servlet containing the regression is
generally active by default).

Affected Versions
=================
Version 4.3.0 only of the Identity Provider, when using the
RemoteUser login flow, either directly, or indirectly via the MFA
login flow feature.

Recommendations
===============
Upgrade to Identity Provider V4.3.1 or later.

References
==========
URL for this Security Advisory
http://shibboleth.net/community/advisories/secadv_20230330.txt

Credits
=======
Tero Marttila, Funidata Oy

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3KoVAHvtneaQzZUjN4uEVAIneWIFAmQlpY8ACgkQN4uEVAIn
eWI3ZhAAlIZZot7ohLh8kw+hizCb3GUySIWSPy1Tu6ZshvPIYBX8br7isZo+44hf
NGWq0s1LlTXBU0bgVAsP+NWUKZqbJXaRFBjxQhqbrb7Ebrl3ifyqPfHRqPU9epcb
vB5Wd38UJ6CpjME+d8LN4+dJF7btA18yz8ipM1Rt+UqKEAhQM5sTiGKJNrMaRcNI
lp6BwVI0VjdsJ0tDMBQmM+N+f6sx+1GW8Lpnq/Pd5UB+a9SZdSaWeJ8wSkSaw62+
NeDm2Pb3GZ90B+Hs/3Ea7kqmxacrK10WSymxu9rFEZ2D74zooIQa/FqIasv0noYu
w3KWQCNtegRxgb5x4EjOUZKRIONbm2D/t+o20HYjw3fdMqOE96/CfgxbN0SksgrI
hiBEVEi+uUPpsxq5ld1OzCJKnCnJxSeRpFmII5Go6DSQ+4ZYwopqzdGb2aQlUe4z
Bs16NgOcCsYq8qQ4RFIlmD88KlchMDsuKz7SMJVqjRA4Gxgol+berA3X6yccBzHy
jXLrKC1wYB4+TBHO/C/M6j9WLRBYa6sEhKRdc4Hfgl7kxmCsUthFhFnhpRmWC569
6HRQyYzbb5bX3u+esfDpl7OIHkYIFVAmTLd1NduPise4fNgvNvZI2W/eaUBVbFKs
sC9pz/xl150rabvEULOEb4wPDBj7vHUhvt1LixGr4YuCmDzVTLI=
=IshG
-----END PGP SIGNATURE-----


-- Scott