| Package | Affected versions | Patched versions |
|---|---|---|
| simplesamlphp/simplesamlphp-module-casserver | ≥ 7.0.0-rc1, < 7.0.0< 6.3.1 | 7.0.06.3.1 |
| simplesamlphp-module-casserver | = 7.0.0< 6.3.1 | 6.3.1 |
The logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url.
There are a number of other things broken with logout in 7 (cas v3 uses a different query parameters, etc)
Previous module checked the url against the valid service urls.
The docker instructions from the README.md run an image with a vulnerable config.
Accessing https://localhost/cas/logout?url=https://google.com will redirect to Google
Impacted configs have
'enable_logout' => true,
and are most impacted if they also have
'skip_logout_page' -> true,
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free