CVE-2024-45409

The Ruby-SAML library does not properly verify the cryptographic signature of the SAML Response returned by the identity provider (IdP). An attacker with access to any SAML document signed by the IdP can use it as a basis to craft their own SAML response or assertion with arbitrary content — including any user identity. The forged document is accepted by the vulnerable system as valid because signature verification is ineffective.

An unauthenticated attacker can log in as any user in a system using the vulnerable library, including as an administrator, leading to full account takeover and unauthorized access to protected resources.

Ruby-SAML should be updated to version 1.17.0 or 1.12.3, in which the vulnerability has been fixed. Users of the omniauth-saml library should update the Ruby-SAML dependency to a secure version according to recommendations published in the vendor's repository.

Ruby-SAML in versions <= 1.12.2 and >= 1.13.0 and <= 1.16.0; omniauth-saml library using vulnerable versions of Ruby-SAML