The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7309-1 advisory.

    It was discovered that Ruby SAML did not properly validate SAML responses. An unauthenticated attacker     could use this vulnerability to log in as an

    abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-5697)

    It was discovered that Ruby SAML incorrectly utilized the results of XML DOM traversal and     canonicalization APIs. An unauthenticated attacker could use this vulnerability to log in as an abitrary     user. This issue only

    affected Ubuntu 16.04 LTS. (CVE-2017-11428)

    It was discovered that Ruby SAML did not properly verify the signature of the SAML Response, allowing     multiple elements with the same ID. An

    unauthenticated attacker could use this vulnerability to log in as an

    abitrary user. (CVE-2024-45409)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2
    and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated
    attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion
    with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable
    system. This vulnerability is fixed in 1.17.0 and 1.12.3. (CVE-2024-45409)

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3949 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3949-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     November 11, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ruby-saml     Version        : 1.11.0-1+deb11u1     CVE ID         : CVE-2024-45409


    It was discovered that ruby-saml, a library for implementing the     client side of a SAML authorization does not properly verify the     signature of the SAML Response. An unauthenticated attacker with     access to any signed saml document (by the IdP) can thus forge a SAML     Response/Assertion with arbitrary contents. This would allow the     attacker to log in as arbitrary user within the vulnerable system.

    For Debian 11 bullseye, this problem has been fixed in version     1.11.0-1+deb11u1.

    We recommend that you upgrade your ruby-saml packages.

    For the detailed security status of ruby-saml please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-saml

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5774 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5774-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 20, 2024                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : ruby-saml     CVE ID         : CVE-2024-45409     Debian Bug     : 1081560

    It was discovered that ruby-saml, a SAML library implementing the client     side of a SAML authorization, does not properly verify the signature of     the SAML Response, which could result in bypass of authentication in an     application using the ruby-saml library.

    For the stable distribution (bookworm), this problem has been fixed in     version 1.13.0-1+deb12u1.

    We recommend that you upgrade your ruby-saml packages.

    For the detailed security status of ruby-saml please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-saml

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3e738678-7582-11ef-bece-2cf05da270f3 advisory.

    Gitlab reports:
    SAML authentication bypass

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
216932	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Ruby SAML vulnerabilities (USN-7309-1)	Nessus	Ubuntu Local Security Checks	critical
416601	SCA: security update for ruby-saml (GHSA-jw9c-mfg7-9rx2)	Tenable Cloud Security	SCA Checks	critical
416601	SCA: security update for ruby-saml (GHSA-jw9c-mfg7-9rx2)	Tenable Self-Hosted Container Security	SCA Checks	critical
210743	Debian dla-3949 : ruby-saml - security update	Nessus	Debian Local Security Checks	critical
207534	Debian dsa-5774 : ruby-saml - security update	Nessus	Debian Local Security Checks	critical
207437	FreeBSD : Gitlab -- vulnerabilities (3e738678-7582-11ef-bece-2cf05da270f3)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2024-45409

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical