PT-2024-6310 · Gitlab+2 · Gitlab+2

Ahacker1-Securesaml · Published 2024-09-10 · Updated 2025-02-28 · CVE-2024-45409

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ruby-SAML versions prior to 1.17.0 Ruby-SAML versions 1.13.0 through 1.16.0 GitLab versions prior to 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10

Description The vulnerability is related to the Ruby SAML library, which is used for implementing the client side of a SAML authorization. The issue arises from the library's failure to properly verify the signature of the SAML Response, allowing an unauthenticated attacker with access to any signed SAML document to forge a SAML Response or Assertion with arbitrary contents. This enables the attacker to bypass the authentication mechanism and potentially gain unauthorized access to sensitive data and critical systems. The vulnerability is actively being exploited, and users are advised to update their GitLab installations to the latest version.

Recommendations For Ruby-SAML versions prior to 1.17.0: Update to version 1.17.0 or later. For Ruby-SAML versions 1.13.0 through 1.16.0: Update to version 1.17.0 or later. For GitLab versions prior to 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10: Update to the respective latest version or apply the security patch. As a temporary workaround, consider enabling two-factor authentication for all user accounts and setting the SAML 2FA bypass parameter to 'do not allow' until a patch is applied.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2024-07261

BIT-GITLAB-2024-45409

CVE-2024-45409

DLA-3949-1

DSA-5774-1

GHSA-CVP8-5R8G-FHVQ

GHSA-JW9C-MFG7-9RX2

USN-7309-1

Affected Products

Gitlab

Linuxmint

Ubuntu

References · 190

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45409.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/CVE-2024-45409.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2024-45409.yml · Exploit
• 🔥 https://github.com/synacktiv/CVE-2024-45409 · Exploit
• https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae · Patch
• https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 · Vendor Advisory
• https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7 · Patch
• https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5774-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cvp8-5r8g-fhvq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45409 · Security Note
• https://osv.dev/vulnerability/DLA-3949-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-45409 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-45409 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11428 · Vendor Advisory