Skip to main content
Apexward Pulse

GitLab

The Ruby SAML library is for implementing the client side of a SAML authorization

CVE-2024-45409

What this means

This is rated critical severity (10 out of 10). Current estimates put the chance of attack in the next 30 days at roughly 11%. Ask IT whether Onelogin Ruby Saml, Omniauth Omniauth Saml and Gitlab Gitlab are in your estate, and treat that as the priority.

Full vendor description

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

Scoring and exploitation

10.0/ 10
CVSS 3.1 base scoreCritical

Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality and integrity, and it can reach beyond the vulnerable system.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeChangedS:C

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityNoneA:N
Elevated attack likelihood (~10.7% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Not confirmed in the
Not reported

Weaknesses

CWE-347

Affected products ()

  • Onelogin Ruby Saml
  • Omniauth Omniauth Saml
  • Gitlab Gitlab
Show the raw CPE strings (5)
  • cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*
  • cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:*
  • cpe:2.3:a:omniauth:omniauth_saml:2.0.0:*:*:*:*:ruby:*:*
  • cpe:2.3:a:omniauth:omniauth_saml:2.1.0:*:*:*:*:ruby:*:*
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*

References

8 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events