identity-authentication-vulnerabilitywidely-deployed-product-advisorydetection-content-updateopen-source-dependency-vulnerability

GitLab Patches Critical SAML Authentication Bypass in Self-Managed Instances

Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Sep 15, 2024

GitLab released emergency security updates across multiple CE and EE versions to fix CVE-2024-45409, a critical SAML authentication bypass affecting self-managed instances configured for SAML-based sign-in. The company said the issue was mitigated by updating omniauth-saml to 2.2.1 and ruby-saml to 1.17.0, and urged administrators to upgrade immediately to patched releases spanning the 17.x and 16.x branches. GitLab.com and GitLab Dedicated were already remediated and were not exposed in the same way.

GitLab also published mitigation and threat-hunting guidance for organizations that could not patch immediately, including enforcing GitLab two-factor authentication for all users and disabling the SAML two-factor bypass option. To help defenders identify attempted or successful exploitation, the advisories pointed to review of application_json and auth_json logs and shared Sigma-style detection ideas focused on anomalous extern_uid values and suspicious IP mismatches during authentication events.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Oct 16, 2010 – Sep 15, 2024

Sep 15, 20242y ago
GitLab releases patches for CVE-2024-45409 in multiple 17.x and 16.11 versions
On 2024-09-17, GitLab released security patch versions 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10 to fix the critical SAML authentication bypass tracked as CVE-2024-45409. GitLab said GitLab.com and GitLab Dedicated were already remediated and urged self-managed customers using SAML to upgrade immediately.
GitLab Critical Patch Release: 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10 | GitLab Docs
Oct 16, 201016y ago
GitLab backports CVE-2024-45409 fix to additional 16.x versions
On 2024-09-25, GitLab released multiple additional 16.x patch versions, including 16.10.10 through 16.0.10, to backport the security fix for the critical SAML authentication bypass CVE-2024-45409. The advisory noted the fix updated omniauth-saml to 2.2.1 and ruby-saml to 1.17.0, and included mitigation and log-hunting guidance for self-managed instances.
GitLab Critical Patch Release: 16.10.10, 16.9.11, 16.8.10, 16.7.10, 16.6.10, 16.5.10, 16.4.7, 16.3.9, 16.2.11, 16.1.8, 16.0.10 | GitLab Docs

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

SAML authentication bypass in Ruby-SAML (CVE-2024-45409)

Affected products

3 linked

GitlabGitlab Community EditionGitlab Enterprise Edition

Organizations

1 linked

GitLab

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Gitlab ReleasesNews · Sep 15, 2024

GitLab Critical Patch Release: 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10 | GitLab DocsOpen source ↗

Gitlab ReleasesNews · Oct 16, 2010

GitLab Critical Patch Release: 16.10.10, 16.9.11, 16.8.10, 16.7.10, 16.6.10, 16.5.10, 16.4.7, 16.3.9, 16.2.11, 16.1.8, 16.0.10 | GitLab DocsOpen source ↗

About GitlabNews

GitLab release notes | GitLab DocsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News