Loading vulnerability…
SAML authentication bypass in Ruby-SAML
CVE-2024-45409 is an improper signature-verification vulnerability in Ruby-SAML affecting releases before 1.12.3 and releases 1.13.0 through 1.16.0. An overly permissive XPath selector used during digest verification can select an attacker-controlled DigestValue outside the expected SignedInfo reference. An attacker possessing an identity-provider-signed SAML document can modify assertion contents and inject a matching digest while preserving the legitimately signed SignedInfo block. Vulnerable service providers consequently accept forged SAML responses or assertions, allowing authentication as an arbitrary user. Applications using Ruby-SAML through OmniAuth-SAML, including GitLab instances configured for SAML authentication, are affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses SAML authentication and allows an unauthenticated attacker to impersonate an arbitrary user in the vulnerable application. The attacker obtains access under that user's application permissions. Identity-provider multifactor authentication alone does not prevent exploitation because the forged response bypasses the normal identity-provider authentication flow.
If you can’t patch tonight, do this now.
If immediate patching is not possible, enforce GitLab two-factor authentication for every user account and disable the SAML two-factor bypass option. Multifactor authentication enforced only by the identity provider does not mitigate this vulnerability. Review SAML authentication and application logs for unusual external identity values, missing or incorrect assertion attributes, and authentication events inconsistent with identity-provider activity.
Patch, then assume compromise.
Upgrade Ruby-SAML to 1.12.3 for the older release branch or 1.17.0 for affected releases 1.13.0 through 1.16.0, or to a later patched release. For affected GitLab CE and EE deployments, install a patched release appropriate to the release branch: 17.3.3, 17.2.7, 17.1.8, 17.0.8, or 16.11.10. Additional backported fixes are available in 16.10.10, 16.9.11, 16.8.10, 16.7.10, 16.6.10, 16.5.10, 16.4.7, 16.3.9, 16.2.11, 16.1.8, and 16.0.10. These GitLab fixes update OmniAuth-SAML to 2.2.1 and Ruby-SAML to 1.17.0.
2 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.