Miggo Logo
Miggo Vulnerability Database
→
CVE-2014-4172

CVE-2014-4172:
Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2014-4172
GHSA ID
GHSA-9fc5-q25c-r2wr
EPSS Score
0.90824%
CWE
CWE-74
Published
5/17/2022
Updated
4/12/2024
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
DotNetCasClientnuget< 1.0.21.0.2
org.jasig.cas:cas-clientmaven< 3.3.23.3.2
jasig/phpcascomposer< 1.3.31.3.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper URL encoding of user-controlled parameters during CAS ticket validation(). The CVE description explicitly identifies two injection points: (1) the 'service' parameter in AbstractUrlBasedTicketValidator.java and (2) the 'pgtUrl' parameter in Cas20ServiceTicketValidator.java. Commit diffs (ae37092, f0e0300, #125) confirm these parameters were added to URLs without proper encoding, allowing attackers to inject arbitrary parameters. The .NET and PHP clients had analogous flaws in their ticket validation() URL construction. All identified functions directly handle these parameters without adequate sanitization, matching the CWE-74 injection pattern described.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* URL p*r*m*t*r inj**tion vuln*r**ility w*s *oun* in t** ***k-***nn*l ti*k*t v*li**tion st*p o* t** **S proto*ol in J*si* J*v* **S *li*nt ***or* *.*.*, .N*T **S *li*nt ***or* *.*.*, *n* p*p**S ***or* *.*.* t**t *llow r*mot* *tt**k*rs to inj**t *r*itr

Reasoning

T** vuln*r**ility st*ms *rom improp*r URL *n*o*in* o* us*r-*ontroll** p*r*m*t*rs *urin* **S ti*k*t `v*li**tion()`. T** *V* **s*ription *xpli*itly i**nti*i*s two inj**tion points: (*) t** 's*rvi**' p*r*m*t*r in `**str**tUrl**s**Ti*k*tV*li**tor.j*v*` *