NetSight
IP …
critical10.0

CVE-2024-45409

SAML authentication bypass via Incorrect XPath selector

Impact

Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability was reported by ahacker1 of SecureSAML (ahacker1@securesaml.com)

Affected packages

EcosystemPackageAffectedFixed in
rubygemsruby-saml< 1.12.31.12.3

Affected products

VendorProductAffected versions
OneloginRuby-Saml
before 1.12.3
from 1.13.0 before 1.17.0
OmniauthOmniauth Saml
through 1.10.3
Versions 2.0.0, 2.1.0
GitlabGitlab
before 16.11.10
from 17.0.0 before 17.0.8
from 17.1.0 before 17.1.8
from 17.2.0 before 17.2.7
from 17.3.0 before 17.3.3

Weakness classification

CWE-347

References