GHSA-cvp8-5r8g-fhvq: 
Ruby vulnerability analysis and mitigation

The vulnerability (CVE-2024-45409) affects Ruby SAML library, which is used for implementing the client side of SAML authorization. The issue was discovered in Ruby-SAML versions <= 1.12.2 and 1.13.0 <= 1.16.0, as well as omniauth-saml versions <= 2.1.0 and <= 1.10.3. The vulnerability was disclosed on September 10, 2024 (GitHub Advisory, NVD).

The vulnerability stems from improper verification of the SAML Response signature (CWE-347). This security flaw allows an unauthenticated attacker with access to any signed SAML document by the Identity Provider (IdP) to forge a SAML Response/Assertion with arbitrary contents. The vulnerability has received a Critical severity rating with a CVSS v3.1 score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) (GitHub Advisory).

The vulnerability enables an attacker to log in as any arbitrary user within the vulnerable system. This poses a severe security risk as it completely bypasses authentication controls, potentially leading to unauthorized access to sensitive information and system resources (GitHub Advisory).

The vulnerability has been fixed in Ruby-SAML versions 1.17.0 and 1.12.3, and in omniauth-saml versions 2.1.2, 1.10.5, and 2.2.1. Users are strongly advised to upgrade to these patched versions to address the security issue (GitHub Advisory).