CVE-2024-45409
criticalpriority · attend · 53EPSS 0.107 · 96 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-24
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- barkotenicholas/CVE-2024-45409barkotenicholas/CVE-2024-45409PoC · poc_in_github
affected products (52)
Products and version ranges known to be affected.
- Synology DiskStation Manager GtiLab for DSM 6.2all versionscert_bundDEcpe:/a:synology:diskstation_manager:gtilab_for_dsm_6.2
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-2162GitLab: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2024-09-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in GitLab und Ruby ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2024-3626Illumio Core: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2024-12-05csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Illumio Core ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- GHSA-jw9c-mfg7-9rx2SAML authentication bypass via Incorrect XPath selector2024-09-10ghsa · osvUS
Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability was reported by ahacker1 of SecureSAML (ahacker1@securesaml.com)
- BIT-gitlab-2024-45409The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector2024-09-21vendor · osvUS
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (17)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-45409/cnnvd
- https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeaecnnvd
- https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7cnnvd
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2cnnvd
- https://vigilance.fr/vulnerability/Ruby-SAML-wrong-signature-check-45176cnnvd
- https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeaeenisa_euvd
- https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7enisa_euvd
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan