CVE-2024-45409

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

• CWE-347

• https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeaePatch
• https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7Patch
• https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2Vendor Advisory
• https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvqVendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/11/msg00006.html
• https://news.ycombinator.com/item?id=41586031
• https://security.netapp.com/advisory/ntap-20240926-0008/
• https://ssoready.com/blog/engineering/ruby-saml-pwned-by-xml-signature-wrapping-attacks/

Published

Sep 10, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45403h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …7.5
• CVE-2024-45404OpenCTI is an open-source cyber threat intelligence platform…8.1
• CVE-2024-45405`gix-path` is a crate of the `gitoxide` project (an implemen…6
• CVE-2024-45406Craft is a content management system (CMS). Craft CMS 5 stor…4.8
• CVE-2024-45407Sunshine is a self-hosted game stream host for Moonlight. Cl…5.3
• CVE-2024-45408eLabFTW is an open source electronic lab notebook for resear…6.5
• CVE-2024-4541The Custom Product List Table plugin for WordPress is vulner…4.3
• CVE-2024-45410Traefik is a golang, Cloud Native Application Proxy. When a …7.5
• CVE-2024-45411Twig is a template language for PHP. Under some circumstance…8.6
• CVE-2024-45412Yeti bridges the gap between CTI and DFIR practitioners by p…7.5
• CVE-2024-45413The HTTPD binary in multiple ZTE routers has a stack-based b…8.1
• CVE-2024-45414The HTTPD binary in multiple ZTE routers has a stack-based b…9.8