{"id":119872,"date":"2024-09-19T21:43:01","date_gmt":"2024-09-19T19:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ruby-saml-pozvolyayushhaya-obojti-autentifikacziyu-v-gitlab"},"modified":"2024-09-19T21:43:01","modified_gmt":"2024-09-19T19:43:01","slug":"uyazvimost-v-ruby-saml-pozvolyayushhaya-obojti-autentifikacziyu-v-gitlab","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-ruby-saml-pozvolyayushhaya-obojti-autentifikacziyu-v-gitlab","title":{"rendered":"Vulnerability in Ruby-SAML allowing authentication bypass in GitLab","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective updates for the GitLab collaborative development platform have been released \u2014 versions 17.3.3, 17.2.6, and 17.1.8, which address a critical vulnerability that allows bypassing SAML (Security Assertion Markup Language) authentication. The issue is due to a vulnerability (CVE-2024-45409) in the Ruby libraries ruby-saml and omniauth-saml, which implement the client side of SAML authorization. The vulnerability has been assigned the highest severity level of 10 out of 10. The issue has been resolved in the updates of the ruby-saml packages (1.17.0 and 1.12.3) and omniauth-saml (2.2.0). <\/p>\n
The vulnerability is due to improper handling of the XPath selector, resulting in an incorrect signature verification in XML format when parsing the response from the SAML server. An unauthenticated attacker with access to any signed SAML document can forge any SAML response for arbitrary content using a typical XML Signature Wrapping (XSW) attack. <\/p>\n
The essence of the attack is to take a correctly signed message and add a additional fictitious message to the associated XML document, using the same identifier as the first message (this identifier will be verified during the parsing of the first message and due to the error will be perceived as verified for the second message as well). In the context of services that use SAML for authentication, this vulnerability allows connection to the system as any user. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"