CVE-2024-45409

10.09.2024, 19:15

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	10 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
GitHub_M	CNA	10 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA-ADP	ADP	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 94%

Vendor	Product	Version
onelogin	ruby-saml	𝑥 < 1.12.3
onelogin	ruby-saml	1.13.0 ≤ 𝑥 < 1.17.0
omniauth	omniauth_saml	𝑥 ≤ 1.10.3
omniauth	omniauth_saml	2.0.0
omniauth	omniauth_saml	2.1.0
gitlab	gitlab	𝑥 < 16.11.10
gitlab	gitlab	17.0.0 ≤ 𝑥 < 17.0.8
gitlab	gitlab	17.1.0 ≤ 𝑥 < 17.1.8
gitlab	gitlab	17.2.0 ≤ 𝑥 < 17.2.7
gitlab	gitlab	17.3.0 ≤ 𝑥 < 17.3.3

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ruby-saml

bullseye	vulnerable
bullseye (security)	1.11.0-1+deb11u2 fixed
bookworm	1.13.0-1+deb12u1 fixed
bookworm (security)	1.13.0-1+deb12u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

ruby-saml

oracular	Fixed 1.15.0-1ubuntu0.24.10.1 released
noble	Fixed 1.15.0-1ubuntu0.24.04.1 released
jammy	Fixed 1.13.0-1ubuntu0.1 released
focal	Fixed 1.11.0-1ubuntu0.1 released
bionic	Fixed 1.7.2-1ubuntu0.1~esm1 released
xenial	Fixed 1.1.2-1ubuntu1+esm1 released

Common Weakness Enumeration

CWE-347 - Improper Verification of Cryptographic Signature
The software does not verify, or incorrectly verifies, the cryptographic signature for data.

References

https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae

https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7

https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2

https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq

https://lists.debian.org/debian-lts-announce/2024/11/msg00006.html

https://news.ycombinator.com/item?id=41586031

https://security.netapp.com/advisory/ntap-20240926-0008/

https://ssoready.com/blog/engineering/ruby-saml-pwned-by-xml-signature-wrapping-attacks/