Corrective updates for the collaborative development platform GitLab have been released—17.9.2, 17.8.5, and 17.7.7—addressing a vulnerability (CVE-2025-25291, CVE-2025-25292) that allows bypassing SAML (Security Assertion Markup Language) authentication. The vulnerability exists in the Ruby library ruby-saml, which implements functions for SAML authorization. Besides GitLab, the vulnerability also affects other projects using this library. The issue has been fixed in ruby-saml updates 1.18.0 and 1.12.4.
The vulnerability stems from differences in XML document parsing between the ReXML and Nokogiri parsers, resulting in different structured documents being generated when processing the same XML document. The issue is that REXML and Nokogiri handle digital signatures in XML documents differently, enabling an attacker to create conditions under which one signature is used for validation and another for user assertion. This capability allows an attacker to exploit an XML Signature Wrapping (XSW) attack method to forge a SAML response for arbitrary content, provided they have access to any signed SAML document.
The issue was identified as a result of GitHub's initiative to consider transitioning to this library and organized a security verification contest (Bug bounty) for testing the environment where the ruby-saml library was used for SAML authentication. One of the security researchers noted the existence of the vulnerability. During the investigation, a GitHub employee discovered another attack vector based on the same principle.
Subsequently, the potential for an attack was confirmed for GitLab. In the context of GitLab, the vulnerability allows an attacker, who has access to any correctly signed SAML document, to impersonate another user, meaning that to bypass authentication and log in as another user, the attacker must already have access to one of the working accounts.
Source: opennet.ru
