CVEvulnerability

CVE-2024-45409

9.8 CRITICAL Published 2024-09-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-09-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-347

Description

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

Affected configurations

• onelogin ruby-saml (< 1.12.3) • onelogin ruby-saml (>= 1.13.0 < 1.17.0) • omniauth omniauth saml (<= 1.10.3) • omniauth omniauth saml 2.0.0 • omniauth omniauth saml 2.1.0 • gitlab gitlab (< 16.11.10) • gitlab gitlab (>= 17.0.0 < 17.0.8) • gitlab gitlab (>= 17.1.0 < 17.1.8) • gitlab gitlab (>= 17.2.0 < 17.2.7) • gitlab gitlab (>= 17.3.0 < 17.3.3)

Related

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References