Ruby SAML 数据伪造问题漏洞

🗓️ 10 Sep 2024 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 4 Views

Ruby SAML data forgery flaw allows login as any user due to SAML response signature verification.

Reporter	Title	Published	Views	Family All 53
FreeBSD	Gitlab -- vulnerabilities	17 Sep 202400:00	–	freebsd
GithubExploit	Exploit for Improper Verification of Cryptographic Signature in Onelogin Ruby-Saml	7 Oct 202409:24	–	githubexploit
GithubExploit	HackTheBox	7 Jun 202617:19	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Aspera Shares is vulnerable to bypass security restrictions and an external entity injection (CVE-2024-45409, CVE-2025-0162)	10 Mar 202518:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Shares	5 Dec 202514:45	–	ibm
BDU FSTEC	The vulnerability of the SAML library for Ruby SAML and the Git-based software platform, which is used for collaborative code development on GitLab, allows for an increase in privileges.	19 Sep 202400:00	–	bdu_fstec
Chainguard	CVE-2024-45409 vulnerabilities	10 Sep 202419:15	–	cgr
Circl	CVE-2024-45409	10 Sep 202421:46	–	circl
CVE	CVE-2024-45409	10 Sep 202418:50	–	cve
Cvelist	CVE-2024-45409 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector	10 Sep 202418:50	–	cvelist

Source	Link
github	www.github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae
github	www.github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
github	www.github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7
cxsecurity	www.cxsecurity.com/cveshow/CVE-2024-45409/
vigilance	www.vigilance.fr/vulnerability/Ruby-SAML-wrong-signature-check-45176

31 Dec 2025 00:00Current

9.5High risk

Vulners AI Score9.5

CVSS 3.19.8 - 10

EPSS0.44644

SSVC

Ruby library data forgery response signature arbitrary login