CVE-2024-45409
Full vulnerability record from the local CVENow database.
Description
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
Severity
CRITICAL
CVSS score
9.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2024-09-10 19:15:22.030000
Last modified
2026-11-04 00:17:21.247000
View original CVE JSON
{
"id": "CVE-2024-45409",
"sourceIdentifier": "[email protected]",
"published": "2024-09-10T19:15:22.030",
"lastModified": "2026-11-04T00:17:21.247",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3."
},
{
"lang": "es",
"value": "La librería Ruby SAML sirve para implementar el lado del cliente de una autorización SAML. Ruby-SAML en <= 12.2 y 1.13.0 <= 1.16.0 no verifica correctamente la firma de la respuesta SAML. Un atacante no autenticado con acceso a cualquier documento SAML firmado (por el IdP) puede falsificar una respuesta/afirmación SAML con contenido arbitrario. Esto le permitiría al atacante iniciar sesión como un usuario arbitrario dentro del sistema vulnerable. Esta vulnerabilidad se solucionó en 1.17.0 y 1.12.3."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "SAML-Toolkits",
"product": "ruby-saml",
"versions": [
{
"version": "< 1.12.3",
"status": "affected"
},
{
"version": ">= 1.13.0, < 1.17.0",
"status": "affected"
}
]
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"vendor": "onelogin",
"product": "ruby-saml",
"defaultStatus": "unknown",
"cpes": [
"cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "0",
"lessThan": "1.12.3",
"versionType": "custom",
"status": "affected"
},
{
"version": "1.13.0",
"lessThan": "1.17.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "omniauth",
"product": "omniauth-saml",
"defaultStatus": "unknown",
"cpes": [
"cpe:2.3:a:omniauth:omniauth-saml:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "0",
"lessThanOrEqual": "2.1.0",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 5.8
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2024-10-16T03:55:12.641512Z",
"id": "CVE-2024-45409",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-347"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.12.3",
"matchCriteriaId": "DF41BEEE-FC5B-4728-B9BE-0B58C04F547E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.13.0",
"versionEndExcluding": "1.17.0",
"matchCriteriaId": "ADBA67BE-BC31-48C0-A36F-9431814178C0"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:*",
"versionEndIncluding": "1.10.3",
"matchCriteriaId": "6D978907-97A8-4EF4-BF81-FE8702C24745"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:omniauth:omniauth_saml:2.0.0:*:*:*:*:ruby:*:*",
"matchCriteriaId": "527AEDE3-F8EB-4C38-AF51-3B679AC4E336"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:omniauth:omniauth_saml:2.1.0:*:*:*:*:ruby:*:*",
"matchCriteriaId": "3F307538-4D4D-4DD1-A9A0-F4D06E20163E"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.11.10",
"matchCriteriaId": "7000556E-4EBB-4B99-84B1-A2EEA709311C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
"versionStartIncluding": "17.0.0",
"versionEndExcluding": "17.0.8",
"matchCriteriaId": "3B47FDB0-B642-4E50-B0B6-1D71545FE917"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
"versionStartIncluding": "17.1.0",
"versionEndExcluding": "17.1.8",
"matchCriteriaId": "86B327A7-22C7-488F-ABA6-3AC90EF07D04"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
"versionStartIncluding": "17.2.0",
"versionEndExcluding": "17.2.7",
"matchCriteriaId": "E831CA83-DDA9-4F47-BCF8-2CBB7E74C9DC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
"versionStartIncluding": "17.3.0",
"versionEndExcluding": "17.3.3",
"matchCriteriaId": "60003658-012F-4DB8-9D8F-8E48C14CA0C4"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00006.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://news.ycombinator.com/item?id=41586031",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240926-0008/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://ssoready.com/blog/engineering/ruby-saml-pwned-by-xml-signature-wrapping-attacks/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}