{"id":122229,"date":"2025-03-15T14:22:06","date_gmt":"2025-03-15T12:22:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-biblioteke-ruby-saml-privodyashhaya-k-obhodu-autentifikaczii-v-gitlab"},"modified":"2025-03-15T14:22:06","modified_gmt":"2025-03-15T12:22:06","slug":"uyazvimost-v-biblioteke-ruby-saml-privodyashhaya-k-obhodu-autentifikaczii-v-gitlab","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-biblioteke-ruby-saml-privodyashhaya-k-obhodu-autentifikaczii-v-gitlab","title":{"rendered":"V vulnerabilitet n\u00eb bibliotek\u00ebn ruby-saml, duke \u00e7uar n\u00eb kalimin e autentikimit n\u00eb GitLab","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Jan\u00eb publikuar p\u00ebrdit\u00ebsime korrigjuese p\u00ebr platform\u00ebn e zhvillimit t\u00eb bashk\u00ebpunimit GitLab \u2014 17.9.2, 17.8.5 dhe 17.7.7, n\u00eb t\u00eb cilat \u00ebsht\u00eb eliminuar nj\u00eb vulnerabilitet (CVE-2025-25291, CVE-2025-25292) q\u00eb mund\u00ebson t\u00eb kalosh autentikimin e bazuar n\u00eb SAML (Security Assertion Markup Language). Vulnerabiliteti \u00ebsht\u00eb i pranish\u00ebm n\u00eb bibliotek\u00ebn Ruby ruby-saml, e cila implementon funksionalitetet p\u00ebr autorizimin SAML. P\u00ebrve\u00e7 GitLab, vulnerabiliteti prekin edhe projekte t\u00eb tjera q\u00eb p\u00ebrdorin k\u00ebt\u00eb bibliotek\u00eb. Problemi \u00ebsht\u00eb zgjidhur n\u00eb p\u00ebrdit\u00ebsimet ruby-saml 1.18.0 dhe 1.12.4. <\/p>\n
Dob\u00ebsia \u00ebsht\u00eb shkaktuar nga ndryshimet n\u00eb analiz\u00ebn e dokumenteve XML nga parser\u00ebt ReXML dhe Nokogiri, si rezultat i t\u00eb cilave, gjat\u00eb p\u00ebrpunimit t\u00eb t\u00eb nj\u00ebjtit dokument XML, gjeneroheshin dokumente me struktura t\u00eb ndryshme. Problemi \u00ebsht\u00eb se REXML dhe Nokogiri i p\u00ebrpunojn\u00eb ndryshe n\u00ebnshkrimet dixhitale n\u00eb dokumentin XML, duke e b\u00ebr\u00eb t\u00eb mundur krijimin e kushteve ku nj\u00eb n\u00ebnshkrim do t\u00eb p\u00ebrdorej p\u00ebr verifikim, nd\u00ebrsa nj\u00eb tjet\u00ebr p\u00ebr akreditimin e p\u00ebrdoruesit. Kjo mund\u00ebsi lejon q\u00eb sulmuesi t\u00eb p\u00ebrdor\u00eb metod\u00ebn e sulmit XSW (XML Signature Wrapping) p\u00ebr t\u00eb falsifikuar nj\u00eb p\u00ebrgjigje SAML p\u00ebr p\u00ebrmbajtje t\u00eb rast\u00ebsishme, duke pasur akses n\u00eb \u00e7do dokument SAML t\u00eb n\u00ebnshkruar. <\/p>\n
Problemi \u00ebsht\u00eb identifikuar si rezultat i iniciativ\u00ebs s\u00eb kompanis\u00eb GitHub, e cila shqyrtonte mund\u00ebsin\u00eb e kalimit t\u00eb GitHub n\u00eb p\u00ebrdorimin e k\u00ebsaj biblioteke dhe me q\u00ebllim t\u00eb verifikimit t\u00eb siguris\u00eb, organizoi nj\u00eb konkurs (Bug bounty) p\u00ebr thyerjen e mjedisit testues, n\u00eb t\u00eb cilin p\u00ebr autentikimin SAML ishte p\u00ebrdorur biblioteka ruby-saml. Nj\u00eb nga k\u00ebrkuesit e siguris\u00eb i kushtoi v\u00ebmendje pranis\u00eb s\u00eb dob\u00ebsis\u00eb. N\u00eb procesin e shqyrtimit t\u00eb problemit, nj\u00eb punonj\u00ebs i GitHub zbuloi nj\u00eb tjet\u00ebr m\u00ebnyr\u00eb sulmi, t\u00eb bazuar mbi t\u00eb nj\u00ebjtin parim. <\/p>\n
M\u00eb tej, mund\u00ebsia e realizimit t\u00eb sulmit \u00ebsht\u00eb konfirmuar p\u00ebr GitLab. N\u00eb kontekstin e GitLab, dob\u00ebsia i lejon sulmuesit, q\u00eb ka akses n\u00eb \u00e7do dokument SAML t\u00eb n\u00ebnshkruar sakt\u00ebsisht, q\u00eb t\u00eb kaloj\u00eb autentikimin si nj\u00eb p\u00ebrdorues tjet\u00ebr, dmth, p\u00ebr t\u00eb kaluar autentikimin dhe p\u00ebr t\u00eb hyr\u00eb si nj\u00eb p\u00ebrdorues tjet\u00ebr, sulmuesi tashm\u00eb duhet t\u00eb ket\u00eb akses n\u00eb nj\u00eb nga llogarit\u00eb e pun\u00ebs. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"