Corrective updates for the collaborative development platform GitLab have been released — versions 17.3.3, 17.2.6, and 17.1.8, which address a critical vulnerability that allows bypassing SAML (Security Assertion Markup Language) authentication. The issue is caused by a vulnerability (CVE-2024-45409) in the Ruby libraries ruby-saml and omniauth-saml, which implement the client-side of SAML authorization. This vulnerability has been assigned a maximum severity level of 10 out of 10. The problem has been fixed in updates to the ruby-saml (1.17.0 and 1.12.3) and omniauth-saml (2.2.0) packages.
The vulnerability is due to improper handling of the XPath selector, resulting in an incorrect signature verification in XML format when parsing the response from the SAML server. An unauthenticated attacker with access to any signed SAML document can forge any SAML response for arbitrary content using a typical XML Signature Wrapping (XSW) attack.
The essence of the attack is to take a correctly signed message and add a additional fictitious message to the associated XML document, using the same identifier as the first message (this identifier will be verified during the parsing of the first message and due to the error will be perceived as verified for the second message as well). In the context of services that use SAML for authentication, this vulnerability allows connection to the system as any user.
Source: opennet.ru
