ruby-saml <=1.12.2 and 1.13.0-1.16.0 - Unauthenticated SAML Signature Verification Bypass
Title source: llmExploitation Summary
CVE-2024-45409 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including synacktiv, exploitintel. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-45409, which manipulates SAML responses by moving the signature into the assertion and inserting a malicious reference to bypass signature validation. The exploit parses a SAML response, modifies its structure, and outputs a crafted response that can be used for authentication bypass.
Description
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
Exploits (2)
This repository contains a functional exploit for CVE-2024-45409, which manipulates SAML responses by moving the signature into the assertion and inserting a malicious reference to bypass signature validation. The exploit parses a SAML response, modifies its structure, and outputs a crafted response that can be used for authentication bypass.
This repository contains a functional exploit for CVE-2024-45409, demonstrating an XML Signature Wrapping attack against ruby-saml to bypass SAML authentication. It includes multiple PoC scripts, a lab setup, and detailed technical analysis.
Nuclei Templates (1)
http.title:"GitLab"
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
