Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409)
Summary
Introduction In this blog post, we will analyze CVE-2024-45409, a critical vulnerability impacting Ruby-SAML, OmniAuth-SAML libraries, which effectively affects GitLab. This vulnerability allows an attacker to bypass SAML authentication mechanisms and gain unauthorized access by exploiting a flaw in how SAML responses are handled. The issue arises due to weaknesses in the verification of the digital signature used to protect SAML assertions, allowing attackers to manipulate the SAML response a
- CVE
- CVE-2024-45409
- Published
- Collected
--- id: 9299 title: "Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409)" cve: CVE-2024-45409 source_domain: projectdiscovery.io source_url: "https://projectdiscovery.io/blog/ruby-saml-gitlab-auth-bypass" published_at: "2024-10-04T21:19:36Z" tags: ["bug-bounty"] phying_url: "https://phying.com/item/9299" lang: en --- # Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409) ## Summary Introduction In this blog post, we will analyze CVE-2024-45409, a critical vulnerability impacting Ruby-SAML, OmniAuth-SAML libraries, which effectively affects GitLab. This vulnerability allows an attacker to bypass SAML authentication mechanisms and gain unauthorized access by exploiting a flaw in how SAML responses are handled. The issue arises due to weaknesses in the verification of the digital signature used to protect SAML assertions, allowing attackers to manipulate the SAML response a ## Intelligence Metadata - **Sources:** projectdiscovery.io - **CVE:** CVE-2024-45409 - **Published:** 2024-10-04T21:19:36Z - **Original:** https://projectdiscovery.io/blog/ruby-saml-gitlab-auth-bypass - **Phying News:** https://phying.com/item/9299