Type Vulnerability
On 12 March 2025, we released versions 17.9.2, 17.8.5, 17.7.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).
GitLab
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
CVE-2025-25291
What this means
This is rated critical severity (9.3 out of 10). There is no confirmed exploitation of it yet. Ask IT whether Omniauth Omniauth Saml, Onelogin Ruby Saml and Netapp Storagegrid are in your estate, and treat that as the priority.
Full vendor description
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
Scoring and exploitation
9.3/ 10
CVSS 4.0 base scoreCritical
Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality and integrity.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Attack requirementsNoneAT:N
Privileges requiredNonePR:N
User interactionNoneUI:N
Impact
Longer bar: more harm
ConfidentialityHighVC:H
IntegrityHighVI:H
AvailabilityNoneVA:N
- Not reported
- Exploited in the wild
- Not confirmed in the
- Not reported
Weaknesses
CWE-347CWE-436
Affected products ()
- Omniauth Omniauth Saml
- Onelogin Ruby Saml
- Netapp Storagegrid
Show the raw CPE strings (3)
- cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:*
- cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*
References
13 links from the CVE record, grouped by site; the vendor's advisory comes first.
github.com6 linksVendor advisory
- e76c5b36bac40aedbf1ba7ffaaf495be63328cd9 (opens in a new tab)Patch
- e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97 (opens in a new tab)Patch
- v1.12.4 (opens in a new tab)Release Notes
Show 3 more from github.com
- v1.18.0 (opens in a new tab)Release Notes
- GHSA-4vc4-m8qh-g8jm (opens in a new tab)Vendor Advisory
- GHSA-hw46-3hmr-x9xv (opens in a new tab)Vendor Advisory
about.gitlab.com1 link
github.blog1 link
- sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials (opens in a new tab)Exploit · Third Party Advisory
portswigger.net1 link
- saml-roulette-the-hacker-always-wins (opens in a new tab)Exploit · Third Party Advisory
securitylab.github.com1 link
- GHSL-2024-329_GHSL-2024-330_ruby-saml (opens in a new tab)Third Party Advisory
lists.debian.org1 link
news.ycombinator.com1 link
- item (opens in a new tab)Issue Tracking
security.netapp.com1 link
- ntap-20250314-0010 (opens in a new tab)Third Party Advisory