External risk intelligence

Ruby SAML Signature Verification Flaw Allows Forging User Logins.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-45409

This vulnerability exists in the Ruby SAML library, which is fundamental to implementing SAML authentication. Because SAML is a standard protocol used by public-facing web applications and identity portals to handle authentication and login flows, vulnerable systems are exposed to the internet by design to facilitate user access.

Onelogin Ruby Saml

before 1.12.31.13.0 to before 1.17.01.10.3 and earlier2.0.02.1.0before 16.11.1017.0.0 to before 17.0.817.1.0 to before 17.1.817.2.0 to before 17.2.717.3.0 to before 17.3.3

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Ruby SAML library, a component used for implementing secure user authentication through SAML. This issue allows an attacker to forge authentication responses, potentially enabling them to impersonate any user within affected systems without needing credentials. The primary concern is to confirm if our systems utilize this library and are exposed to this risk.

Forged logins are possible via SAML.
This impacts authentication and user access.
Verify usage and assess exposure to this risk.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could reach this vulnerability by obtaining a SAML response document that has been signed by the Identity Provider. The attacker would then forge a new SAML Response or Assertion with fabricated content, which, if processed by the vulnerable Ruby SAML library, could allow them to log in as any user.

Requires access to signed SAML documents.
Triggers when the library fails to verify the SAML signature.
Enables attackers to impersonate arbitrary users.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated attacker could forge SAML responses to impersonate any user within a vulnerable system. This could affect access to services and any data or functionality available to those users.

User authentication and access.
Forging SAML responses.
Unauthorized user access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Systems leveraging the Ruby SAML library, including those using `omniauth-saml` and GitLab, are vulnerable to unauthenticated attackers forging SAML assertions to impersonate users. Infrastructure, platform, and application owners must prioritize identifying all instances of the affected Ruby SAML versions. Confirming reachability and business criticality will inform risk-based remediation planning, which may involve vendor coordination for updates or temporary mitigation strategies.

Application and platform teams own the issue.
Verify SAML configurations and network exposure.
Plan for vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ruby SAML library?

The Ruby SAML library is a toolset developers use to build SAML-based authentication into their web applications. It serves as the client-side mechanism that processes and validates the secure login tokens sent by an Identity Provider, ensuring users are who they claim to be when accessing protected web services.

How does this vulnerability work in CVE-2024-45409?

This flaw is classified under CWE-347, which involves improper verification of cryptographic signatures. Because the library fails to correctly check the signature on a SAML Response, it can be tricked into accepting forged authentication data. An attacker can essentially swap the contents of a valid document to log in as anyone, bypassing the security controls that should have protected the login process.

Do I need a valid account to trigger this bug?

No. The attack does not require a pre-existing account or prior authentication. An attacker simply needs access to any legitimate, signed SAML document issued by the Identity Provider to use as a template. The vulnerability is not triggered by standard, valid SAML flows; it occurs specifically when the system processes a maliciously altered document that the flawed library fails to validate.

Why is this a risk for my organization?

Halo Surface Signal indicates this vulnerability is highly relevant because SAML is inherently designed to handle user authentication for web-based services. Since these systems are typically exposed to the internet to allow remote user access, any application relying on the affected Ruby SAML versions is directly reachable by external threats looking to gain unauthorized access to user accounts.

How do I address this CVE?

Your first step is to identify all applications in your environment that utilize the affected Ruby SAML or omniauth-saml libraries, as well as platforms like GitLab that bundle them. Once identified, prioritize updating these components to the patched versions—1.17.0 or 1.12.3 for the core library—to ensure proper signature verification is restored and login integrity is protected.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.