GitLab Patches Critical SAML Authentication Bypass Flaw in CE and EE Editions
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-27348 | Unauthenticated RCE in Apache HugeGraph-Server 1.0.0-1.2.x Apache HugeGraph-Server versions 1.0.0 through versions before 1.3.0 contain an improper access control flaw (CWE-284) that enables unauthenticated remote code execution through the server's network-facing API when the authentication system is not enabled. An attacker with network access to a vulnerable server can send crafted requests that execute arbitrary commands on the host with no credentials, privileges, or user interaction required, consistent with the CVSS 9.8 network/low-complexity vector. All deployments of HugeGraph-Server 1.0.0-1.2.x running on Java 8 or Java 11 are affected, especially instances exposed to untrusted networks with auth disabled. Exploitation is active: the bug was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-18, public reporting says it is under attack, and EPSS assigns a 99.2% probability of exploitation within 30 days (100th percentile). CISA's required action is to apply vendor mitigations per vendor instructions or discontinue use of the product. Do: Upgrade to Apache HugeGraph-Server 1.3.0 running on Java 11 and enable the authentication (Auth) system, which fixes the issue per the vendor. If upgrading is not immediately possible, restrict network access to the HugeGraph-Server API to trusted clients and enable auth, and audit internet-exposed instances for signs of exploitation. Because this flaw is in CISA's KEV catalog, federal agencies and other bound organizations must apply the vendor mitigations or discontinue use by the required deadline. | 9.8 | 99% | KEV PoC |
| nichelikely only thousands of internet-exposed instances at most | |
| CVE-2024-45409 | The Ruby SAML library is for implementing the client side of a SAML authorization. The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3. NVD description · AI analysis pending | 9.8 | 11% |
| — |
Full article421 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 19, 2024Enterprise Security / DevOps
GitLab has released patches to address a critical flaw impacting Community Edition (CE) and Enterprise Edition (EE) that could result in an authentication bypass.
The vulnerability is rooted in the ruby-saml library (CVE-2024-45409, CVSS score: 10.0), which could allow an attacker to log in as an arbitrary user within the vulnerable system. It was addressed by the maintainers last week.
The problem as a result of the library not properly verifying the signature of the SAML Response. SAML, short for Security Assertion Markup Language, is a protocol that enables single sign-on (SSO) and exchange of authentication and authorization data across multiple apps and websites.
"An unauthenticated attacker with access to any signed SAML document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents, according to a security advisory. "This would allow the attacker to log in as arbitrary user within the vulnerable system."
It's worth noting the flaw also impacts omniauth-saml, which shipped an update of its own (version 2.2.1) to upgrade ruby-saml to version 1.17.
The latest patch from GitLab is designed to update the dependencies omniauth-saml to version 2.2.1 and ruby-saml to 1.17.0. This includes versions 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10.
As mitigations, GitLab is urging users of self-managed installations to enable two-factor authentication (2FA) for all accounts and disallow the SAML two-factor bypass option.
GitLab makes no mention of the flaw being exploited in the wild, but it has provided indicators of attempted or successful exploitation, suggesting that threat actors may be actively trying to capitalize on the shortcomings to gain access to susceptible GitLab instances.
"Successful exploitation attempts will trigger SAML related log events," it said. "A successful exploitation attempt will log whatever extern_id value is set by the attacker attempting exploitation."
"Unsuccessful exploitation attempts may generate a ValidationError from the RubySaml library. This could be for a variety of reasons related to the complexity of crafting a working exploit."
The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, including a recently disclosed critical bug impacting Apache HugeGraph-Server (CVE-2024-27348, CVSS score: 9.8), based on evidence of active exploitation.
Federal Civilian Executive Branch (FCEB) agencies have been recommended to remediate the identified vulnerabilities by October 9, 2024, to protect their networks against active threats.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/09/gitlab-patches-critical-saml.html