Description
The SAML SSO Service Provider module turns a Drupal site into a SAML service provider so that users can sign in through an external identity provider.
During account registration an earlier release of the module wrote the administrator's miniOrange account password in cleartext into the Drupal variables table, and although the release that removed the registration flow no longer writes or reads that value, it never deletes the copy that older versions left behind, so on any site upgraded from such a release the password remains readable in the live database and in every database dump or backup taken afterwards.
This vulnerability is mitigated by the fact that reading the stored value requires access to the database or to a backup rather than an anonymous web request, and that fresh installations and sites that never completed miniOrange registration are not affected.
Solution
Install the latest version.
If you use the SAML SSO - Service Provider module for Drupal 7, upgrade to SAML SSO - Service Provider 7.x-2.75:
After upgrading, run update.php so that database update 7201 deletes the orphaned account password, account API token and registration transaction identifier from the variables table. Because the value has already been exposed in the live database and in any backups taken while it was stored, sites should also rotate the affected miniOrange account password.
Reported by
Fixed by
Coordinated by
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Tag1 D7ES