Listen to this Post
The casserver module’s `FileSystemTicketStore` builds file paths by directly concatenating a base ticket directory with an attacker‑controlled ticket identifier. This identifier is taken from the `ticket` or `pgt` query parameters of public CAS validation and proxy endpoints without validation. By including path traversal sequences like ../target.serialized, an attacker can make the server read and unserialize arbitrary files outside the intended ticket directory. The vulnerable code then calls `unserialize()` on the fetched file content, which is inherently dangerous if an attacker can plant a malicious serialized object. In the CAS 1.0 validation flow, the same attacker‑supplied path is passed to `deleteTicket()` immediately after getTicket(). Because `deleteTicket()` attempts to delete the file regardless of CAS semantics, the attacker can delete any file that is both readable and deletable by the PHP process, provided its content unserializes to a value compatible with the `?array` return type (e.g., a serialized array or null). The issue requires the casserver module to be enabled, the file‑based ticket store to be in use, and the CAS validation/proxy endpoints to be reachable. It does not require any administrative privileges. This vulnerability enables both arbitrary file read/unserialize and conditional file deletion, with potential for further compromise if a serialized object can be placed on the server.
Platform: SimpleSAMLphp
Version: <6.3.1, <7.0.0‑rc3
Vulnerability: Path traversal
Severity: High
Date: 2026‑05‑14
Prediction: 2026‑05‑21
What Undercode Say:
Check if casserver module is enabled and FileSystemTicketStore is used grep -r "enable" /path/to/simplesamlphp/config/module_casserver.php grep -r "FileSystemTicketStore" /path/to/simplesamlphp/modules/casserver/lib/Store/
// PoC: request with path traversal $ticket = "../../../path/to/sensitive/file.serialized"; $url = "https://target.com/simplesamlphp/module.php/casserver/validate?ticket=" . urlencode($ticket);
Exploit:
Send a GET request to a public CAS validation endpoint (e.g., `/validate` or /proxy) with the `ticket` parameter set to a path traversal payload like ../config/config.php. For CAS 1.0, the same payload also triggers deletion of the targeted file.
Protection from this CVE:
Upgrade to `simplesamlphp-module-casserver` version 6.3.1 or 7.0.0 (or later). As a workaround, switch to a non‑file‑based ticket store (e.g., database or memcache) or sanitize the ticket identifier before path construction.
Impact:
Remote attacker can read and unserialize arbitrary files (leading to info disclosure or object injection) and, under certain conditions, delete arbitrary files writable by the PHP process (e.g., CAS tickets, cache files, or other application data).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
