{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2024-45409","sourceIdentifier":"security-advisories@github.com","published":"2024-09-10T19:15:22.030","lastModified":"2026-11-04T00:17:21.247","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in \u003c= 12.2 and 1.13.0 \u003c= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3."},{"lang":"es","value":"La librería Ruby SAML sirve para implementar el lado del cliente de una autorización SAML. Ruby-SAML en \u0026lt;= 12.2 y 1.13.0 \u0026lt;= 1.16.0 no verifica correctamente la firma de la respuesta SAML. Un atacante no autenticado con acceso a cualquier documento SAML firmado (por el IdP) puede falsificar una respuesta/afirmación SAML con contenido arbitrario. Esto le permitiría al atacante iniciar sesión como un usuario arbitrario dentro del sistema vulnerable. Esta vulnerabilidad se solucionó en 1.17.0 y 1.12.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"SAML-Toolkits","product":"ruby-saml","versions":[{"version":"\u003c 1.12.3","status":"affected"},{"version":"\u003e= 1.13.0, \u003c 1.17.0","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"onelogin","product":"ruby-saml","defaultStatus":"unknown","cpes":["cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"1.12.3","versionType":"custom","status":"affected"},{"version":"1.13.0","lessThan":"1.17.0","versionType":"custom","status":"affected"}]},{"vendor":"omniauth","product":"omniauth-saml","defaultStatus":"unknown","cpes":["cpe:2.3:a:omniauth:omniauth-saml:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThanOrEqual":"2.1.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-16T03:55:12.641512Z","id":"CVE-2024-45409","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*","versionEndExcluding":"1.12.3","matchCriteriaId":"DF41BEEE-FC5B-4728-B9BE-0B58C04F547E"},{"vulnerable":true,"criteria":"cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*","versionStartIncluding":"1.13.0","versionEndExcluding":"1.17.0","matchCriteriaId":"ADBA67BE-BC31-48C0-A36F-9431814178C0"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:*","versionEndIncluding":"1.10.3","matchCriteriaId":"6D978907-97A8-4EF4-BF81-FE8702C24745"},{"vulnerable":true,"criteria":"cpe:2.3:a:omniauth:omniauth_saml:2.0.0:*:*:*:*:ruby:*:*","matchCriteriaId":"527AEDE3-F8EB-4C38-AF51-3B679AC4E336"},{"vulnerable":true,"criteria":"cpe:2.3:a:omniauth:omniauth_saml:2.1.0:*:*:*:*:ruby:*:*","matchCriteriaId":"3F307538-4D4D-4DD1-A9A0-F4D06E20163E"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*","versionEndExcluding":"16.11.10","matchCriteriaId":"7000556E-4EBB-4B99-84B1-A2EEA709311C"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*","versionStartIncluding":"17.0.0","versionEndExcluding":"17.0.8","matchCriteriaId":"3B47FDB0-B642-4E50-B0B6-1D71545FE917"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*","versionStartIncluding":"17.1.0","versionEndExcluding":"17.1.8","matchCriteriaId":"86B327A7-22C7-488F-ABA6-3AC90EF07D04"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*","versionStartIncluding":"17.2.0","versionEndExcluding":"17.2.7","matchCriteriaId":"E831CA83-DDA9-4F47-BCF8-2CBB7E74C9DC"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*","versionStartIncluding":"17.3.0","versionEndExcluding":"17.3.3","matchCriteriaId":"60003658-012F-4DB8-9D8F-8E48C14CA0C4"}]}]}],"references":[{"url":"https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00006.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://news.ycombinator.com/item?id=41586031","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20240926-0008/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://ssoready.com/blog/engineering/ruby-saml-pwned-by-xml-signature-wrapping-attacks/","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}