CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-45409

Critical Severity
Onelogin
SVRS
87/100
CVSSv3
9.8/10
EPSS
0.14907/1

CVE-2024-45409 is a critical SAML signature bypass vulnerability in the Ruby SAML library. This flaw allows unauthenticated attackers to forge SAML responses, potentially granting them unauthorized access to systems. CVE-2024-45409 affects Ruby-SAML versions less than or equal to 1.12.2 and versions 1.13.0 through 1.16.0. With an SVRS score of 87, indicating a critical risk, immediate patching to versions 1.17.0 or 1.12.3 is essential. Due to active exploits being available in the wild, the risk of exploitation is significantly elevated. This vulnerability allows an attacker to log in as any user, making it a high-priority security concern for any organization using the affected Ruby-SAML library. Organizations should implement the patch immediately to prevent unauthorized access and potential data breaches. The flawed signature verification process is the root cause, requiring careful attention to SAML implementation security.

TAGS
In The Wild
Exploit Avaliable
VECTOR STRING
CVSS:3.1
AV:N
AC:L
PR:N
UI:N
S:U
C:H
I:H
A:H
PUBLICATION DATE2024-09-10
LAST MODIFIED2024-09-20
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-45409 is a critical vulnerability in the Ruby SAML library, which is used for implementing the client side of a SAML authorization. The vulnerability allows an unauthenticated attacker to forge a SAML Response/Assertion with arbitrary contents, which could allow them to log in as an arbitrary user within the vulnerable system. This vulnerability is fixed in versions 1.17.0 and 1.12.3.

Key Insights

  • The CVSS score of 10 indicates that this is a critical vulnerability that should be addressed immediately.
  • The SVRS score of 38 indicates that this vulnerability is not as severe as some other vulnerabilities, but it is still significant and should be addressed.
  • This vulnerability is actively exploited by hackers, so it is important to patch vulnerable systems as soon as possible.

Mitigation Strategies

  • Update to Ruby SAML version 1.17.0 or 1.12.3.
  • Restrict access to the SAML Response/Assertion.
  • Implement additional security measures, such as two-factor authentication.

Additional Information

  • Threat Actors/APT Groups: This vulnerability is being actively exploited by hackers, but there are no specific threat actors or APT groups that have been identified as exploiting it.
  • Exploit Status: Active exploits have been published.
  • CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of this vulnerability, calling for immediate and necessary measures.
  • In the Wild: This vulnerability is actively exploited by hackers.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.

Indicators of Compromise

No IOCs found for this CVE

Exploits

TitleSoftware LinkDate
synacktiv/CVE-2024-45409https://github.com/synacktiv/CVE-2024-454092024-10-07
Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

ISC StormCast for Tuesday, November 12th, 2024
Dr. Johannes B. Ullrich2024-11-12
ISC StormCast for Tuesday, November 12th, 2024 | Daily 5 min cyber security news summary. News, patches, vulnerabilities and trends in information and network security. PDF Phish Analysis; Mazda Vulns; Ruby SAML Vuln Details; Veeam Vuln; Fake FBI EDRs;PDF Object Streams https://isc.sans.edu/diary/PDF%20Object%20Streams/31430 Mazda Infotainment Vulnerabilities https://www.zerodayinitiative.com/blog/2024/11/7/multiple-vulnerabilities-in-the-mazda-in-vehicle-infotainment-ivi-system Ruby SAML CVE-2024-45409: As bad as it gets and hiding in plain sight https://workos.com/blog/ruby-saml-cve-2024-45409<br
sans.edu
rss
forum
news
GitLab Critical Patch Release: 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10
Rohit Shambhuni2025-04-01
GitLab Critical Patch Release: 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10 | Today we are releasing versions 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. All GitLab Dedicated instances have been
gitlab.com
rss
forum
news
GitLab Critical Patch Release: 16.10.10, 16.9.11, 16.8.10, 16.7.10, 16.6.10, 16.5.10, 16.4.7, 16.3.9, 16.2.11, 16.1.8, 16.0.10
Greg Myers2025-04-01
GitLab Critical Patch Release: 16.10.10, 16.9.11, 16.8.10, 16.7.10, 16.6.10, 16.5.10, 16.4.7, 16.3.9, 16.2.11, 16.1.8, 16.0.10 | Today we are releasing versions 16.10.10, 16.9.11, 16.8.10, 16.7.10, 16.6.10, 16.5.10, 16.4.7, 16.3.9, 16.2.11, 16.1.8, and 16.0.10 for GitLab Community Edition (CE) and Enterprise Edition (EE). This extends the security fixes previously added to 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10. These versions contain backports of an important security fix which was previously released for GitLab
gitlab.com
rss
forum
news
GitHub Uncovers New ruby-saml Vulnerabilities Allowing Account Takeover Attacks
Ajit Jasrotia2025-03-13
GitHub Uncovers New ruby-saml Vulnerabilities Allowing Account Takeover Attacks | Two high-severity security flaws have been disclosed in the open-source ruby-saml library that could allow malicious actors to bypass Security Assertion Markup Language (SAML) authentication protections. SAML is an XML-based markup language and open-standard used for exchanging authentication and authorization data between parties, enabling features like single sign-on (SSO), which allows individuals to use a [&#8230;] The post GitHub Uncovers New ruby-saml Vulnerabilities Allowing Account Takeover Attacks
allhackernews.com
rss
forum
news
Sign in as anyone: Bypassing SAML SSO authentication with parser differentials
Peter Stöckli2025-03-12
Sign in as anyone: Bypassing SAML SSO authentication with parser differentials | Critical authentication bypass vulnerabilities (CVE-2025-25291 + CVE-2025-25292) were discovered in ruby-saml up to version 1.17.0. In this blog post, we'll shed light on how these vulnerabilities that rely on a parser differential were uncovered. The post Sign in as anyone: Bypassing SAML SSO authentication with parser differentials appeared first on The GitHub Blog.
github.blog
rss
forum
news
USN-7309-1: Ruby SAML vulnerabilities
2025-02-28
USN-7309-1: Ruby SAML vulnerabilities | It was discovered that Ruby SAML did not properly validate SAML responses. An unauthenticated attacker could use this vulnerability to log in as an abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-5697) It was discovered that Ruby SAML incorrectly utilized the results of XML DOM traversal and canonicalization APIs. An unauthenticated attacker could use this vulnerability to log in as an abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-11428) It was discovered that Ruby SAML did not properly verify the signature of the SAML Response, allowing
ubuntu.com
rss
forum
news
Data Breaches Digest - Week 41 2024
Dunkie ([email protected])2024-12-02
Data Breaches Digest - Week 41 2024 | Welcome to this week's Data Breaches Digest, a catalogue of links concerning Data Breaches and Cyber Security that were published on the Internet during the period between 7th October and 13th October 2024. 13th October <br
dbdigest.com
rss
forum
news

Social Media

Ruby SAML CVE-2024-45409: As bad as it gets and hiding in plain sight #RubySAML #CVE202445409 #SecurityFlaw #WorstCaseScenario #OpenSourceVulnerability https://t.co/0wJsz891FD
0
0
1
The latest update for #Kondukto includes "Ruby affected by CVE-2024-45409" and "#Linux Kernel effected by CVE-2023-2163". #Cybersecurity #AppSec #DevSecOps https://t.co/H3OXfk9UJd
0
0
0
#Dontmiss #Hotstuff #News #authentication #exploit Exploit code for critical GitLab auth bypass flaw released (CVE-2024-45409) https://t.co/51Sshq4i2R
0
0
1
Exploit code for critical GitLab auth bypass flaw released (CVE-2024-45409): If you run a self-managed GitLab installation with configured SAML-based authentication and you haven’t upgraded it since mid-September, do it now, because security researchers… https://t.co/ZhXMy3bQe5 https://t.co/soDrUkC8dd
0
0
0
#Exploit code for critical #GitLab auth bypass flaw released (CVE-2024-45409) https://t.co/F4qV001UHu https://t.co/fDILbw4n8m
0
0
0
Exploit code for critical GitLab auth bypass flaw released (CVE-2024-45409) - https://t.co/S6iuLzvvRC - @gitlab @pdiscoveryio @Synacktiv #Authentication #Exploit #PoC #SecurityUpdate #Vulnerability #CyberSecurity #InfoSecurity #CISO #ITsecurity #CyberSecurityNews #SecurityNews
0
0
0
GitLab Authentication Bypass (CVE-2024-45409) : https://t.co/rFmYnJXj4K credits: @rootxharsh @iamnoooob https://t.co/TcdasAzchQ
0
0
1
Researchers Detail Ruby-SAML/GitLab Flaw (CVE-2024-45409) Allows SAML Authentication Bypass https://t.co/Yfn6gE4YRe
0
0
3
Researchers Detail Ruby-SAML/#GitLab Flaw (CVE-2024-45409) Allows SAML Authentication Bypass Understand the impact of the CVE-2024-45409 vulnerability that allows bypassing #SAML authentication and gaining unauthorized access. https://t.co/e1O4pBhxAl
0
0
0
Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409) https://t.co/2EYMKLYrsY #Pentesting #Bypass #Vulnerability #CyberSecurity #Infosec https://t.co/oHHvYxqqA8
0
1
2

Affected Software

Configuration 1
TypeVendorProduct
AppOneloginruby-saml
Configuration 2
TypeVendorProduct
AppOmniauthomniauth_saml
Configuration 3
TypeVendorProduct
AppGitlabgitlab

References

ReferenceLink
[email protected]https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae
[email protected]https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7
[email protected]https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
[email protected]https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae
[email protected]https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7
[email protected]https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
[email protected]https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq

CWE Details

CWE IDCWE NameDescription
CWE-347Improper Verification of Cryptographic SignatureThe software does not verify, or incorrectly verifies, the cryptographic signature for data.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence