CVE-2024-45409: The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-10 · updated 2026-06-17
Weakness: CWE-347

Description

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

Affected products

GitLab: before 16.11.10; from 17.0.0 before 17.0.8; from 17.1.0 before 17.1.8; from 17.2.0 before 17.2.7; from 17.3.0 before 17.3.3 — fixed in 16.11.10, 17.0.8, 17.1.8, 17.2.7, 17.3.3
OmniAuth OmnitAuth-SAML: through 1.10.3; 2.0.0, 2.1.0
SAML-Toolkits ruby-saml: before 1.12.3; from 1.13.0 before 1.17.0 — fixed in 1.12.3, 1.17.0
Rubygems Ruby-Saml: before 1.12.3; from 1.13.0 before 1.17.0; 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.2.1, 0.2.2 (+78) — fixed in 1.12.3, 1.17.0

How to fix

Upgrade to a fixed version: GitLab 16.11.10, 17.0.8, 17.1.8, 17.2.7; SAML-Toolkits ruby-saml 1.12.3, 1.17.0; Rubygems Ruby-Saml 1.12.3, 1.17.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-45409 or the next vulnerability affects your stack