CVE-2024-45409: 
Ruby vulnerability analysis and mitigation

The Ruby SAML library, used for implementing the client side of SAML authorization, contains a critical vulnerability (CVE-2024-45409) affecting versions ≤ 12.2 and 1.13.0 ≤ 1.16.0. The vulnerability stems from improper verification of SAML Response signatures, allowing an unauthenticated attacker with access to any signed SAML document to forge SAML Response/Assertions with arbitrary contents (GitHub Advisory, NVD).

The vulnerability arises from an incorrect XPath selector that prevents proper verification of the SAML Response signature. The core issue lies in the XML signature verification process where there's no guarantee that the URI the signature points to is unique. An attacker can exploit this by taking a legitimate message and inserting additional content into the message while reusing the same URI, potentially confusing the victim's code about what was actually signed (SSOReady).

Successful exploitation of this vulnerability allows an attacker to bypass authentication mechanisms and log in as any arbitrary user within the vulnerable system. This affects multiple systems including GitLab Community Edition (CE) and Enterprise Edition (EE), and other applications using the vulnerable Ruby-SAML versions (GitLab Release).

The vulnerability has been fixed in Ruby-SAML versions 1.17.0 and 1.12.3. For systems that cannot immediately update, GitLab recommends two mitigation measures: 1) Enable two-factor authentication for all user accounts on the GitLab self-managed instance (Note: Enabling identity provider multi-factor authentication does not mitigate this vulnerability), and 2) Do not allow the SAML two-factor bypass option in GitLab (GitLab Release).

The vulnerability has garnered significant attention in the security community, with experts criticizing the complexity of XML signatures and SAML implementation. The issue has been described as 'yet another XML signature wrapping attack' affecting huge portions of the internet, particularly the Ruby ecosystem (SSOReady).