On the organization of collaborative development platform GitLab, version 17.3.3, 17.2.6, and 17.1.8, corrective updates have been released, which fix a critical vulnerability that allows bypassing SAML (Security Assertion Markup Language) authentication. The issue is caused by a vulnerability (CVE-2024-45409) in the Ruby libraries ruby-saml and omniauth-saml, which implement the client side of SAML authorization. This vulnerability has been assigned the maximum danger level of 10 out of 10. The problem has been fixed in updates for the ruby-saml packages (1.17.0 and 1.12.3) and omniauth-saml (2.2.0).
The vulnerability is caused by improper handling of the XPath selector, leading to incorrect signature verification in XML format when parsing the response from the SAML server. An unauthenticated attacker with access to any signed SAML document can forge any SAML response for arbitrary content using a typical XSW (XML Signature Wrapping) attack.
The essence of the attack is to take a correctly signed message and add an additional fake message to the related XML document, using the same identifier as the first message (this identifier will be verified when parsing the first message and, due to the error, will be perceived as verified for the second message). In the context of services using SAML for authentication, the vulnerability allows logging into the system as any user.
Allikas: opennet.ru
