CVE-2021-31826

Vulnerability

Shibboleth Service Provider versions 3.x prior to 3.2.2 contain a NULL pointer dereference vulnerability in the cookie-based session recovery feature introduced in V3.0 [1]. The flaw is reachable even on systems that do not use this feature, provided a specially crafted cookie is supplied [1].

Exploitation

A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted cookie to the target system [1]. No prior knowledge of the session or any authentication is required; the cookie triggers the NULL pointer dereference in the session recovery code path, causing a crash of the shibd daemon process [1].

Impact

Successful exploitation results in a denial of service (DoS) condition due to the crash of the shibd daemon [1]. The crash can be easily triggered remotely, making the system unavailable for processing authentication requests [1].

Mitigation

Update to Shibboleth Service Provider version 3.2.2 or later, which contains the fix for this issue [1]. As a workaround, configuring a DataSealer component in shibboleth2.xml (even if not used for anything else) will prevent the crash [1]. Note that versions prior to V3.0 are not vulnerable [1]. The fix commit is 5a47c3b9378f4c49392dd4d15189b70956f9f2ec in the cpp-sp repository [2].