ruby-saml Authentication Bypass Vulnerability via Signature Wrapping Attack

An authentication bypass vulnerability has been identified in the ruby-saml library, specifically in versions prior to 1.18.0. This vulnerability arises from a parser differential between ReXML and Nokogiri, which can generate entirely different document structures from the same XML input. As a result, an attacker could exploit this discrepancy to execute a Signature Wrapping attack, bypassing authentication mechanisms.

Impact

Exploitation of this vulnerability allows for authentication bypass, enabling unauthorized access to resources or functionalities that require user authentication.

Reproduction

To reproduce this vulnerability, use a version of the ruby-saml library prior to 1.18.0. Create a SAML response that includes a signature and an assertion. The response should be crafted in a way that takes advantage of the different XML parsing behaviors of Nokogiri and ReXML. When the response is processed, the parser differential will be exploited, allowing for a Signature Wrapping attack that bypasses authentication.

Remediation

Users can upgrade to ruby-saml version 1.18.0 or later to address this vulnerability.