Executive brief
OneLogin ruby-saml is a library used by Ruby applications to handle Single Sign-On (SSO) authentication. A vulnerability in how the library verifies digital signatures allows an attacker to bypass authentication or impersonate other users. This could lead to unauthorized access to sensitive corporate applications and data without needing a valid password.
Technical details
The ruby-saml library prior to version 1.3.0 is vulnerable to XML Signature Wrapping (XSW). This vulnerability class occurs when the library incorrectly validates the digital signature of a SAML assertion, allowing an attacker to inject unauthorized XML elements that the application processes as valid while the signature remains cryptographically sound for a different part of the document. An unauthenticated remote attacker can exploit this to manipulate SAML responses and gain unauthorized access. The fix in version 1.3.0 introduces three additional validations to ensure the integrity of the signed elements relative to the document structure.
Affected products
- OneLogin ruby-saml < 1.3.0
Timeline
- 2016-06-24: disclosed: Initial disclosure on oss-security mailing list
- 2016-06-24: patched: Version 1.3.0 released with extra validations
- 2017-01-23: advisory: NVD publication date