Improper verification of cryptographic signature in SAML SSO for Ruby - CVE-2024-45409
Published: September 18, 2024 / Updated: October 11, 2024
Vulnerability identifier: #VU97454
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-45409
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to bypass SAML authentication.
The vulnerability exists due to the library does not properly verify the signature of the SAML Response. A remote non-authenticated attacker with access to any signed SAML document (by the IdP) can forge a SAML Response/Assertion with arbitrary contents, bypass authentication process and login under an arbitrary account within the application.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected application.
Affected software
SAML SSO for Ruby
omniauth-saml
Debian Linux
GitLab Enterprise Edition
Gitlab Community Edition
ruby-saml (Debian package)
omniauth-saml
Debian Linux
GitLab Enterprise Edition
Gitlab Community Edition
ruby-saml (Debian package)
How to mitigate CVE-2024-45409
Install updates from vendor's website.
SAML SSO for Ruby - addressed in versions 1.12.3, 1.17.0
omniauth-saml - update to 2.2.1
GitLab Enterprise Edition - addressed in versions 16.11.10, 17.0.8, 17.1.8, 17.2.7, 17.3.3
Gitlab Community Edition - addressed in versions 16.11.10, 17.0.8, 17.1.8, 17.2.7, 17.3.3
ruby-saml (Debian package) - update to 1.13.0-1+deb12u1
omniauth-saml - update to 2.2.1
GitLab Enterprise Edition - addressed in versions 16.11.10, 17.0.8, 17.1.8, 17.2.7, 17.3.3
Gitlab Community Edition - addressed in versions 16.11.10, 17.0.8, 17.1.8, 17.2.7, 17.3.3
ruby-saml (Debian package) - update to 1.13.0-1+deb12u1