This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Ruby SAML and OmniAuth SAML (used e.g. in GitLab) fix 1 critical vulnerability

Ruby SAML and OmniAuth SAML fix a critical vulnerability. Ruby SAML fixes the vulnerability in versions 1.17.0 and 1.12.3 and OmniAuth SAML in version 2.2.0 [1]. The vulnerability also affects all products that use one of the mentioned libraries, such as GitLab. GitLab Community Edition (CE) and Enterprise Edition (EE) fix this vulnerability in versions 17.3.3, 17.2.7, 17.1.8, 17.0.8 and 16.11.10. As a temporary fix for GitLab, two-factor authentication can be configured (not the multi-factor authentication of the identity provider) and its bypass disabled. Options for finding successful and unsuccessful attempts to exploit the vulnerability can be found at [2].

Ruby SAML, OmniAuth SAML - SAML response forge (CVE-2024-45409)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can gain access to any service by impersonating another user, by sending a specially crafted SAML response [1].

The vulnerability is present in products:

  • Omniauth-SAML; <2.2.0;
  • Ruby-SAML; <1.12.3; >=1.13.0, <1.17.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 10. 9. 2024.

By CESNET, z.s.p.o. Martin Krajči on 19. 9. 2024.

CESNET, z.s.p.o. Logo