# CVE-2022-39369: php-cas: phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentic...

CVE-2022-39369 is fixed in 3 products on 1 platform, first by ocsinventory-reports 2.8.1+dfsg1-1ubuntu0.1, released November 1, 2022. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-39369
- Priority: High
- CVSS: 8.0 (high)
- EPSS: 0.0243
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 1, 2022

## Description

phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a valid ticket granted for any authorized service in the same SSO realm (CAS server) to authenticate to the service protected by phpCAS. Depending on the settings of the CAS server service registry in worst case this may be any other service URL (if the allowed URLs are configured to "^(https)://.*") or may be strictly limited to known and authorized services in the same SSO federation if proper URL service validation is applied. This vulnerability may allow an attacker to gain access to a victim's account on a vulnerable CASified service without victim's knowledge, when the victim visits attacker's website while being logged in to the same CAS server. phpCAS 1.6.0 is a major version upgrade that starts enforcing service URL discovery validation, because there is unfortunately no 100% safe default config to use in PHP. Starting this version, it is required to pass in an additional service base URL argument when constructing the client class. For more information, please refer to the upgrading doc. This vulnerability only impacts the CAS client that the phpCAS library protects against. The problematic service URL discovery behavior in phpCAS < 1.6.0 will only be disabled, and thus you are not impacted from it, if the phpCAS configuration has the following setup: 1. `phpCAS::setUrl()` is called (a reminder that you have to pass in the full URL of the current page, rather than your service base URL), and 2. `phpCAS::setCallbackURL()` is called, only when the proxy mode is enabled. 3. If your PHP's HTTP header input `X-Forwarded-Host`, `X-Forwarded-Server`, `Host`, `X-Forwarded-Proto`, `X-Forwarded-Protocol` is sanitized before reaching PHP (by a reverse proxy, for example), you will not be impacted by this vulnerability either. If your CAS server service registry is configured to only allow known and trusted service URLs the severity of the vulnerability is reduced substantially in its severity since an attacker must be in control of another authorized service. Otherwise, you should upgrade the library to get the safe service discovery behavior.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | ocsinventory-reports Ubuntu 22.04.1 LTS (jammy) | 2.8.1+dfsg1-1ubuntu0.1 | [ocsinventory-reports 2.8.1+dfsg1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ocsinventory-reports-2.8.1-dfsg1-1ubuntu0.1.md) | Nov 1, 2022 |
| Linux | ocsinventory-server Ubuntu 22.04.1 LTS (jammy) | 2.8.1+dfsg1-1ubuntu0.1 | [ocsinventory-server 2.8.1+dfsg1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ocsinventory-server-2.8.1-dfsg1-1ubuntu0.1.md) | Nov 1, 2022 |
| Linux | php-cas Debian 12.15 (bookworm) | 1.6.0-1 | [DEBIAN-CVE-2022-39369](https://patchblox.com/security/data/fix/linux/debian-cve-2022-39369.md) | Nov 1, 2022 |
| Linux | php-cas Debian 13.5 (trixie) | 1.6.0-1 | [DEBIAN-CVE-2022-39369](https://patchblox.com/security/data/fix/linux/debian-cve-2022-39369.md) | Nov 1, 2022 |
| Linux | php-cas Debian 14 | 1.6.0-1 | [DEBIAN-CVE-2022-39369](https://patchblox.com/security/data/fix/linux/debian-cve-2022-39369.md) | Nov 1, 2022 |
| Linux | php-cas Ubuntu 20.04 LTS (focal) | 1.3.8-1ubuntu0.20.04.1 | [php-cas 1.3.8-1ubuntu0.20.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-php-cas-1.3.8-1ubuntu0.20.04.1.md) | Nov 1, 2022 |
| Linux | php-cas Ubuntu 22.04.1 LTS (jammy) | 1.3.8-1ubuntu0.22.04.1 | [php-cas 1.3.8-1ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-php-cas-1.3.8-1ubuntu0.22.04.1.md) | Nov 1, 2022 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.