SAML-Toolkits ruby-saml up to 1.12.2/1.16.x SAML Response signature verification

Summaryinfo

A vulnerability was found in SAML-Toolkits ruby-saml up to 1.12.2/1.16.x. It has been classified as critical. The affected element is an unknown function of the component SAML Response Handler. Performing a manipulation results in signature verification. This vulnerability is reported as CVE-2024-45409. The attack is possible to be carried out remotely. Moreover, an exploit is present. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in SAML-Toolkits ruby-saml up to 1.12.2/1.16.x. It has been classified as critical. This affects an unknown code block of the component SAML Response Handler. The manipulation with an unknown input leads to a signature verification vulnerability. CWE is classifying the issue as CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-45409 since 08/28/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available.

The exploit is shared for download at packetstormsecurity.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 210743 (Debian dla-3949 : ruby-saml - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.12.3 or 1.17.0 eliminates this vulnerability. Applying the patch 1ec5392bc506fe43a02dbb66b68741051c5ffeae is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (210743). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• SAML-Toolkits

Name

• ruby-saml

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.12.0
• 1.12.1
• 1.12.2
• 1.13
• 1.14
• 1.15
• 1.16

License

• open-source

Website

• Product: https://github.com/SAML-Toolkits/ruby-saml/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion