PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Fragile Lock: Novel Bypasses For SAML Authentication

portswigger.net | research | #appsec | #ruby | #authentication-bypass | #php | #web-security | #saml | #xml-signature | #parser-discrepancies
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Novel SAML signature-wrapping attacks — attribute pollution, namespace confusion and Void Canonicalization — achieve full authentication bypass in Ruby and PHP libraries, including GitLab Enterprise.
Published
Collected

Related coverage

research · portswigger.net
Gotta cache 'em all: bending the rules of web cache exploitation
Doyhenard's research exploits URL parser discrepancies and RFC ambiguities between CDNs and origins — delimiters, normalization, static extensions — achieving arbitrary cache poisoning and deception.
research · portswigger.net
Bypassing WAFs with the phantom $Version cookie
Legacy $Version cookies downgrade parsers into RFC2109 mode, and frameworks — Flask, Django, PHP, Spring — disagree on the result. The discrepancies can be abused to smuggle attacks past WAFs.
research · portswigger.net
Splitting the email atom: exploiting parsers to bypass access controls
Email parser discrepancies — quoted values, Unicode overflows, encoded-word, malformed Punycode — become access control bypasses and RCE, with cases against GitHub, Zendesk, GitLab and Joomla.
research · portswigger.net
SAML roulette: the hacker always wins
Chaining XML round-trip attacks and namespace confusion yields unauthenticated admin access on GitLab Enterprise via ruby-saml, using comment and CDATA mutations that defeat signature verification.
research · depthfirst.com
Behind the GitLab RCE: A depthfirst Journey into the Ruby Ecosystem
The investigation shows how memory-safety flaws in native Ruby gems can become remotely reachable through widely deployed applications such as GitLab. Teams should inventory native-extension dependencies and move self-managed GitLab and Oj installations to fixed releases.
research · depthfirst.com
Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities
We chained two memory-safety flaws in Oj, a native Ruby JSON parser used by GitLab's notebook diff renderer, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.
Back