{"action":"created","issue":{"url":"https://api.github.com/repos/salesagility/SuiteCRM/issues/2819","repository_url":"https://api.github.com/repos/salesagility/SuiteCRM","labels_url":"https://api.github.com/repos/salesagility/SuiteCRM/issues/2819/labels{/name}","comments_url":"https://api.github.com/repos/salesagility/SuiteCRM/issues/2819/comments","events_url":"https://api.github.com/repos/salesagility/SuiteCRM/issues/2819/events","html_url":"https://github.com/salesagility/SuiteCRM/issues/2819","id":197086546,"number":2819,"title":"Update PHP-SAML library to 2.10.0 to fix login security vulnerability","user":{"login":"chris001","id":259416,"avatar_url":"https://avatars3.githubusercontent.com/u/259416?v=3","gravatar_id":"","url":"https://api.github.com/users/chris001","html_url":"https://github.com/chris001","followers_url":"https://api.github.com/users/chris001/followers","following_url":"https://api.github.com/users/chris001/following{/other_user}","gists_url":"https://api.github.com/users/chris001/gists{/gist_id}","starred_url":"https://api.github.com/users/chris001/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chris001/subscriptions","organizations_url":"https://api.github.com/users/chris001/orgs","repos_url":"https://api.github.com/users/chris001/repos","events_url":"https://api.github.com/users/chris001/events{/privacy}","received_events_url":"https://api.github.com/users/chris001/received_events","type":"User","site_admin":false},"labels":[{"id":57696485,"url":"https://api.github.com/repos/salesagility/SuiteCRM/labels/bug","name":"bug","color":"e11d21","default":true},{"id":185381912,"url":"https://api.github.com/repos/salesagility/SuiteCRM/labels/Fix%20Proposed","name":"Fix Proposed","color":"bfe5bf","default":false},{"id":253714754,"url":"https://api.github.com/repos/salesagility/SuiteCRM/labels/High%20Priority","name":"High Priority","color":"e11d21","default":false},{"id":332487553,"url":"https://api.github.com/repos/salesagility/SuiteCRM/labels/Resolved:%20Next%20Release","name":"Resolved: Next Release","color":"6e5494","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-12-22T03:25:11Z","updated_at":"2017-03-10T19:24:03Z","closed_at":"2017-02-27T17:31:58Z","body":"<!--- Provide a general summary of the issue in the **Title** above -->\r\n<!--- Before you open an issue, please check if a similar issue already exists or has been closed before. --->\r\nThe SAML integration is based on a very old 2010 version of the Onelogin's SAML toolkit, which was found to be vulnerable to a signature-wrapping attack.\r\n\r\n#### Issue\r\n<!--- Provide a more detailed introduction to the issue itself, and why you consider it to be a bug -->\r\nSAML is used to provide single sign on to web applications.\r\n\r\n#### Expected Behavior\r\n<!--- Tell us what should happen -->\r\nUpdate the SAML library to prevent login attacks.\r\n\r\n#### Actual Behavior\r\n<!--- Tell us what happens instead -->\r\nThe signature wrapping attack allows an attacker to login to a user account by signing the request multiple times.\r\n\r\n#### Possible Fix\r\n<!--- Not obligatory, but suggest a fix or reason for the bug -->\r\n* The PHP-SAML library should be updated and use the latest version 2.10.0 or newer, which has fixed the security issue:\r\nhttps://github.com/onelogin/php-saml\r\n\r\n* The PHP-SAML toolkit also supports composer. You can find the `onelogin/php-saml` package at https://packagist.org/packages/onelogin/php-saml\r\n\r\nIn order to import the latest version of the saml toolkit, run:\r\n`composer require onelogin/php-saml`\r\n\r\nAfter installation has completed you'll find inside the `vendor/` folder a new folder named `onelogin` and inside, `php-saml`. Make sure you are including the autoloader provided by composer. It can be found at `vendor/autoload.php`.\r\n\r\nImportant: When using composer, the x509 certs must be stored at `vendor/onelogin/php-saml/certs` and settings file stored at `vendor/onelogin/php-saml`.\r\n\r\nYour settings are at risk of being deleted when updating packages using `composer update` or similar commands. **So it is highly recommended that instead of using settings files, you pass the settings as an array directly to the constructor.** If you do not use this approach your settings are at risk of being deleted when updating packages using `composer update` or similar commands.\r\n\r\n#### Steps to Reproduce\r\n<!--- Provide a link to a live example, or an unambiguous set of steps to -->\r\n<!--- reproduce this bug include code to reproduce, if relevant -->\r\n1.  See PHP-SAML github page for more details on the signature wrapping hack and their fix. https://github.com/onelogin/php-saml\r\n> Update php-saml to 2.10.0 or newer, this version includes code to perform extra verification and prevent signature wrapping login attacks.\r\n> php-saml < v2.10.0 is vulnerable and allows signature wrapping!\r\n\r\n#### Context\r\n<!--- How has this bug affected you? What were you trying to accomplish? -->\r\n<!--- If you feel this should be a low/medium/high priority then please state so -->\r\nMedium-High priority.  It's a serious security issue.  SAML is such a popular method of login because it's fast, protects passwords, reduces password proliferation.  The PHP application SuiteCRM doesn't hold any user password data, only the identity provider, such as microsoft, facebook, twitter, google, holds the user's password data.  The SuiteCRM PHP application is much harder to hack when users are logging in with SAML, because the hacker would need to attack the security of the Identity Provider (social network typically) yet social networks typically run high security, are constantly audited by world class security teams, and send highly deliverable email and push notifications, to the user, of any suspicious login activity coming from new devices and new locations.\r\n\r\n#### Your Environment\r\n<!--- Include as many relevant details about the environment you experienced the bug in -->\r\n* SuiteCRM Version used:\r\n* Browser name and version (e.g. Chrome Version 51.0.2704.63 (64-bit)): Mozilla Firefox 51\r\n* Environment name and version (e.g. MySQL, PHP 7): MySQL 5.7, PHP 7.\r\n* Operating System and version (e.g Ubuntu 16.04): Debian 8.\r\n"},"comment":{"url":"https://api.github.com/repos/salesagility/SuiteCRM/issues/comments/285761033","html_url":"https://github.com/salesagility/SuiteCRM/issues/2819#issuecomment-285761033","issue_url":"https://api.github.com/repos/salesagility/SuiteCRM/issues/2819","id":285761033,"user":{"login":"chris001","id":259416,"avatar_url":"https://avatars3.githubusercontent.com/u/259416?v=3","gravatar_id":"","url":"https://api.github.com/users/chris001","html_url":"https://github.com/chris001","followers_url":"https://api.github.com/users/chris001/followers","following_url":"https://api.github.com/users/chris001/following{/other_user}","gists_url":"https://api.github.com/users/chris001/gists{/gist_id}","starred_url":"https://api.github.com/users/chris001/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chris001/subscriptions","organizations_url":"https://api.github.com/users/chris001/orgs","repos_url":"https://api.github.com/users/chris001/repos","events_url":"https://api.github.com/users/chris001/events{/privacy}","received_events_url":"https://api.github.com/users/chris001/received_events","type":"User","site_admin":false},"created_at":"2017-03-10T19:24:03Z","updated_at":"2017-03-10T19:24:03Z","body":"If it only needs quotes around the URL, that's a simple fix.\r\nFor saml tracer do you mean this : https://addons.mozilla.org/en-GB/firefox/addon/saml-tracer/\r\nOr these for chrome: https://www.samltool.com/saml_tools.php\r\n"}}
{"actor":{"display_login":"chris001"}}