{"id":"CVE-2024-45409","published":"2024-09-10T18:50:12Z","modified":"2024-11-11T17:02:31Z","title":"The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector","vendor":"SAML-Toolkits","product":"ruby-saml","tier":"core","eol":null,"affectedVersions":[{"vendor":"SAML-Toolkits","product":"ruby-saml","versions":["< 1.12.3",">= 1.13.0, < 1.17.0"]}],"description":{"text":"The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Ruby SAML library (ruby-saml from SAML-Toolkits) does not properly verify the signature of SAML Responses in affected versions. The flaw lies in the library's client-side SAML authorization handling. An unauthenticated attacker with access to any document signed by the identity provider can forge a SAML Response or Assertion with arbitrary contents and log in as any user in the vulnerable system, requiring no authentication, user interaction, or special configuration beyond use of the affected library.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:31Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.10684,"percentile":0.95802,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-10-15","exploitedFirstSeen":"2024-10-15","ransomware":false,"evidence":[{"url":"https://cyble.com/blog/active-exploitation-of-saml-vulnerability-cve-2024-45409-detected-by-cyble-sensors/","date":"2024-10-15"},{"url":"https://cyble.com/blog/cyble-sensors-detect-attacks-on-ivanti-php-saml-network-devices-and-more/","date":"2024-12-24"},{"url":"https://e.cyberint.com/hubfs/IAB%20Report%202025.pdf","date":"2025-04-10"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"Midwest Malware","url":"https://otx.alienvault.com/pulse/6a8e6c8dc6d3df83aac08378","created":"2026-08-26"},{"name":"Cellbrite Domain Irregularities","url":"https://otx.alienvault.com/pulse/699e98024aa93957a620e117","created":"2026-02-25"}],"provenance":"machine"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"references":[{"url":"https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq","tags":["x_refsource_MISC"]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae","tags":["x_refsource_MISC"]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7","tags":["x_refsource_MISC"]},{"url":"https://ssoready.com/blog/engineering/ruby-saml-pwned-by-xml-signature-wrapping-attacks/","tags":[]},{"url":"https://news.ycombinator.com/item?id=41586031","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20240926-0008/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00006.html","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"RubyGems","package":"ruby-saml","vulnerableRanges":["<1.12.3",">=1.13.0, <1.17.0"],"patched":["1.12.3","1.17.0"],"from":["GHSA-jw9c-mfg7-9rx2"],"provenance":"source"}],"advisories":[{"id":"GHSA-jw9c-mfg7-9rx2","url":"https://github.com/advisories/GHSA-jw9c-mfg7-9rx2","severity":"CRITICAL","ecosystem":"RubyGems","package":"ruby-saml","vulnerableRanges":["<1.12.3"],"patched":["1.12.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jw9c-mfg7-9rx2","url":"https://github.com/advisories/GHSA-jw9c-mfg7-9rx2","severity":"CRITICAL","ecosystem":"RubyGems","package":"ruby-saml","vulnerableRanges":[">=1.13.0, <1.17.0"],"patched":["1.17.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-2828","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2828","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":1,"earliest":"2024-10-07","earliestUrl":"https://github.com/synacktiv/CVE-2024-45409","repos":[{"name":"synacktiv/CVE-2024-45409","url":"https://github.com/synacktiv/CVE-2024-45409","stars":86,"created":"2024-10-07"}]},"first":{"date":"2024-10-07","source":"PoC-in-GitHub","url":"https://github.com/synacktiv/CVE-2024-45409"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-09-10","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-45409","provenance":"source"},{"date":"2024-10-07","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/synacktiv/CVE-2024-45409","provenance":"source"},{"date":"2024-10-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cyble.com/blog/active-exploitation-of-saml-vulnerability-cve-2024-45409-detected-by-cyble-sensors/","provenance":"source"}],"speed":{"daysToPublicExploit":27,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":67.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 746 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.16,"detail":"percentile 0.9580"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-saml-toolkits-ruby-saml-cve-2024-45409","children":[{"from":"CVE-2024-45409","to":"CVE-2025-25291","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:ruby-saml","fromFixed":"1.12.3","toFixed":"1.12.4","daysApart":183},{"kind":"same-code","provenance":"machine","files":["lib/xml_security.rb"],"commits":["https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae","https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7","https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9","https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97"],"basis":"shared function","functions":["validate_signature"]}]},{"from":"CVE-2024-45409","to":"CVE-2025-25292","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:ruby-saml","fromFixed":"1.12.3","toFixed":"1.12.4","daysApart":183},{"kind":"same-code","provenance":"machine","files":["lib/xml_security.rb"],"commits":["https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae","https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7","https://github.com/SAML-Toolkits/ruby-saml/commit/e76c5b36bac40aedbf1ba7ffaaf495be63328cd9","https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97"],"basis":"shared function","functions":["validate_signature"]}]},{"from":"CVE-2024-45409","to":"CVE-2025-66567","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/xml_security.rb"],"commits":["https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae","https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7","https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97"],"basis":"shared function","functions":["validate_signature"]}]}],"packageHistory":[{"cve":"CVE-2015-20108","published":"2023-05-27","fixed":"1.0.0","kev":false},{"cve":"CVE-2016-5697","published":"2017-01-23","fixed":"1.3.0","kev":false},{"cve":"CVE-2017-11428","published":"2019-04-17","fixed":"1.7.0","kev":false},{"cve":"CVE-2024-45409","published":"2024-09-10","fixed":"1.17.0","kev":false},{"cve":"CVE-2025-25291","published":"2025-03-12","fixed":"1.18.0","kev":false},{"cve":"CVE-2025-25292","published":"2025-03-12","fixed":"1.18.0","kev":false},{"cve":"CVE-2025-25293","published":"2025-03-12","fixed":"1.18.0","kev":false,"link":{"from":"CVE-2024-45409","to":"CVE-2025-25293","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:ruby-saml","fromFixed":"1.12.3","toFixed":"1.12.4","daysApart":183}]}}],"package":"RubyGems:ruby-saml"}}