Is CVE-2016-5697 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-5697 being exploited in the wild.

How severe is CVE-2016-5697?

High severity, with a CVSS score of 7.5, published 23 January 2017.

Which products and versions are affected?

ruby-saml (RubyGems) ECOSYSTEM:introduced=0,fixed=1.3.0.

Is there a fix for CVE-2016-5697?

Yes. ruby-saml (RubyGems): upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-5697 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-5697?

Check whether you run Onelogin Ruby-Saml or ruby-saml (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-5697: OneLogin ruby-saml XML signature wrapping attack

CVE-2016-5697 · Severity: high · CVSS 7.5 · Published 2017-01-23

OneLogin ruby-saml is a library used by Ruby applications to handle Single Sign-On (SSO) authentication. A vulnerability in how the library verifies digital signatures allows an attacker to bypass authentication or impersonate other users. This could lead to unauthorized access to sensitive corporate applications and data without needing a valid password.

Technologies: Onelogin Ruby-Saml, ruby-saml (RubyGems). Vendors: Onelogin, RubyGems.

Quick answers

Is CVE-2016-5697 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-5697 being exploited in the wild.
How severe is CVE-2016-5697?: High severity, with a CVSS score of 7.5, published 23 January 2017.
Which products and versions are affected?: ruby-saml (RubyGems) ECOSYSTEM:introduced=0,fixed=1.3.0.
Is there a fix for CVE-2016-5697?: Yes. ruby-saml (RubyGems): upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-5697 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-5697?: Check whether you run Onelogin Ruby-Saml or ruby-saml (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ruby-saml (RubyGems): upgrade to 1.3.0 or later
```
bundle update ruby-saml
```

Technical details

The ruby-saml library prior to version 1.3.0 is vulnerable to XML Signature Wrapping (XSW). This vulnerability class occurs when the library incorrectly validates the digital signature of a SAML assertion, allowing an attacker to inject unauthorized XML elements that the application processes as valid while the signature remains cryptographically sound for a different part of the document. An unauthenticated remote attacker can exploit this to manipulate SAML responses and gain unauthorized access. The fix in version 1.3.0 introduces three additional validations to ensure the integrity of the signed elements relative to the document structure.

Affected products

OneLogin ruby-saml < 1.3.0

Identifiers

CVE-2016-5697
GHSA-36p7-xjw8-h6f2

Timeline

2016-06-24: disclosed: Initial disclosure on oss-security mailing list
2016-06-24: patched: Version 1.3.0 released with extra validations
2017-01-23: advisory: NVD publication date

References

http://www.openwall.com/lists/oss-security/2016/06/24/3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.