{"id":9853,"date":"2025-03-13T13:22:27","date_gmt":"2025-03-13T13:22:27","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/github-new-ruby-saml-vulns-allow-account-takeovers\/"},"modified":"2025-03-13T13:22:28","modified_gmt":"2025-03-13T13:22:28","slug":"github-new-ruby-saml-vulns-allow-account-takeovers","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/github-new-ruby-saml-vulns-allow-account-takeovers\/","title":{"rendered":"GitHub: New ruby-saml vulns allow account takeovers"},"content":{"rendered":"\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Mar 13, 2025<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\">Authentication \/ Vulnerability<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhA6N08S9nEoa7-9P1vwpC4BaoLAk0A5PeSPjxxK0R9DwoB4hvIKnfwLse_2jGPa4tqARKRooAuEoFUhA9yMjnqFs-DMhyoikwkfkxFv0X3OXRSY1s-SMP2vOlMOzmybaKyT4TppafpdY_ajRi42hLlp07AHSngslzKwgfkCuioo3ECaQEflD75disRcefa\/s728-rw-e365\/auth.png\" style=\"clear: left; display: block; float: left;  text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><\/a><\/div>\n<p>Security researchers have identified two critical vulnerabilities in the open-source ruby-saml library, which could potentially allow malicious actors to bypass Security Assertion Markup Language (SAML) authentication mechanisms.<\/p>\n<p>SAML is a standardized XML-based language used for exchanging authentication and authorization data between different parties, enabling features such as single sign-on (SSO), where individuals can use a single set of credentials to access multiple sites, services, and applications.<\/p>\n<p>The discovered vulnerabilities, tracked as <a href=\"https:\/\/github.com\/advisories\/GHSA-4vc4-m8qh-g8jm\" rel=\"noopener nofollow\" target=\"_blank\">CVE-2025-25291<\/a> and <a href=\"https:\/\/github.com\/advisories\/GHSA-754f-8gm6-c4r2\" rel=\"noopener nofollow\" target=\"_blank\">CVE-2025-25292<\/a>, have a CVSS score of 8.8 out of 10.0 and affect the following versions of the library &#8211;<\/p>\n<ul>\n<li>&lt; 1.12.4<\/li>\n<li>&gt;= 1.13.0, &lt; 1.18.0<\/li>\n<\/ul>\n<p>The root cause of these vulnerabilities lies in the different ways REXML and Nokogiri parse XML, resulting in distinct document structures from the same input. This parser differential allows an attacker to carry out a Signature Wrapping attack, ultimately bypassing authentication. The vulnerabilities have been <a href=\"https:\/\/github.com\/SAML-Toolkits\/ruby-saml\/releases\/tag\/v1.18.0\" rel=\"noopener nofollow\" target=\"_blank\">addressed<\/a> in ruby-saml versions 1.12.4 and 1.18.0.<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/cloud-secure-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><img fetchpriority=\"high\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhPWsOsc5-XgG7OgLaedicSgtFyWz34mXvDdyCyBN0HSv2LVBMQPs-Ma8uaYGqN19Mvm7puED6vlOFihpguPFfq-e_PQ6pfqHPeMKSX6luNSqXs_m3IHmaA6waPe8qHtxB35qw_CdmXzEDQ30crRU_-UvN9w8cSL1W51CocP1fJXyJIrdUcBNvSaMyhb_cV\/s728-e100\/cloud-secure-d.jpg\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>According to Microsoft-owned GitHub, which discovered and reported the flaws in November 2024, these vulnerabilities can be exploited by malicious actors to conduct account takeover attacks.<\/p>\n<p>&#8220;An attacker who has obtained a valid signature created with the key used for validating SAML responses or assertions can use it to create their own SAML assertions, thereby logging in as any user,&#8221; explained Peter St\u00f6ckli, a researcher at GitHub Security Lab, in a <a href=\"https:\/\/github.blog\/security\/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials\/\" rel=\"noopener nofollow\" target=\"_blank\">post<\/a>.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgshtx4Z5c4AR4jGddsVtuKdDZDiDzVIbi2Z5H8e6hIBT9MPKzFBPx5j3mIrt2CmSaNBMTLwnn8JR4a2ckxQ9T7MG2PUxP8ddUf52jk9C49saC_U7sKBE8lYrVYRsX20MThKCWNwmmtHf9brWHl0XW2fn4KdAQYP2XMt6mbC5nQ2cZ_XF8Xz7Dt5-GhyphenhyphenOst\/s728-rw-e365\/attack.png\" style=\"clear: left; display: block; float: left;  text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgshtx4Z5c4AR4jGddsVtuKdDZDiDzVIbi2Z5H8e6hIBT9MPKzFBPx5j3mIrt2CmSaNBMTLwnn8JR4a2ckxQ9T7MG2PUxP8ddUf52jk9C49saC_U7sKBE8lYrVYRsX20MThKCWNwmmtHf9brWHl0XW2fn4KdAQYP2XMt6mbC5nQ2cZ_XF8Xz7Dt5-GhyphenhyphenOst\/s728-rw-e365\/attack.png\" alt=\"\" border=\"0\" data-original-height=\"599\" data-original-width=\"1534\"\/><\/a><\/div>\n<p>GitHub noted that the issue arises from a &#8220;disconnect&#8221; between hash verification and signature verification, allowing exploitation via parser differentials.<\/p>\n<p>Versions 1.12.4 and 1.18.0 also fix a remote denial-of-service (DoS) vulnerability when handling compressed SAML responses (CVE-2025-25293, CVSS score: 7.7). Users are advised to update to the latest version to avoid potential threats.<\/p>\n<p>These findings come nearly six months after GitLab and ruby-saml addressed another critical vulnerability (<a href=\"https:\/\/thehackernews.com\/2024\/09\/gitlab-patches-critical-saml.html\" rel=\"noopener nofollow\" target=\"_blank\">CVE-2024-45409<\/a>, CVSS score: 10.0) that could also result in an authentication bypass. <\/p>\n<p><\/p>\n<div class=\"cf note-b\">Found this article interesting?  Follow us on <a href=\"https:\/\/twitter.com\/thehackersnews\" rel=\"noopener nofollow\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a> and <a href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" rel=\"noopener nofollow\" target=\"_blank\">LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/03\/github-uncovers-new-ruby-saml.html\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue802Mar 13, 2025\ue804Ravie LakshmananAuthentication \/ Vulnerability Security researchers have identified two critical vulnerabilities in the open-source ruby-saml library, which could potentially allow malicious actors to bypass Security Assertion Markup Language&#8230;<\/p>\n","protected":false},"author":19,"featured_media":9854,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-9853","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/03\/auth.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/9853","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=9853"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/9853\/revisions"}],"predecessor-version":[{"id":9855,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/9853\/revisions\/9855"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/9854"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=9853"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=9853"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=9853"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}