DevOps platform GitLab patched a critical-severity flaw found in its Community Edition (CE) and Enterprise Edition (EE) solutions, which could grant malicious users access to restricted information.
The flaw, described as a “SAML authentication bypass”, is tracked as CVE-2024-45409, and carries the perfect severity score of 10/10. Short Assertion Markup Language (SAML), is a web-based authentication protocol facilitating, among other things, the single sign-on (SSO) feature.
It was discovered that the ryb-saml library wasn’t verifying the signature of the SAML Response properly, allowing threat actors to log in.
No evidence of abuse
“An unauthenticated attacker with access to any signed SAML document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents,” GitHub explained in a security advisory. “This would allow the attacker to log in as arbitrary user within the vulnerable system.”
Those worried about compromise should make sure their Community Edition and Enterprise Edition solutions are upgraded to versions 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10. Those unable to apply the patch right now should enable two-factor authentication (2FA) for all accounts, and disallow the SAML two-factor bypass option.
While GitHub did not explicitly state if the vulnerability was abused in the wild yet or not, its wording in the security advisory is somewhat telling. In the document, the maintainers shared details on spotting both successful and unsuccessful exploitation attempts suggesting, at least, that the crooks might be trying their luck already.
GitLab is a web-based DevOps platform that provides tools for version control, continuous integration/continuous delivery (CI/CD), and software development lifecycle management. It helps teams collaborate on code, automate testing, and streamline deployment processes and has tens of millions of active users. As such, it is a high-profile target for all sorts of cybercriminals.
Via The Hacker News
