GitLab releases patches to fix a critical SAML authentication bypass in Gitlab Community and Enterprise
Take action: If you are running GitLab CE/EE update your servers ASAP, or enforce MFA with no SAML MFA bypass. While this attack is primarily focused on SAML authentication (Signle Sign On), most self hosted GitLab instances are either SAML authenticated or there is some test config to check for SAML, so there is ample attack surface for hacker to exploit. Patch ASAP, don't delay.
Learn More
GitLab has released security updates to fix a critical SAML authentication bypass vulnerability, tracked as CVE-2024-45409 (CVSS score 10).
The flaw affects self-hosted/self-managed instances of GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability originates from issues in the OmniAuth-SAML and Ruby-SAML libraries, which GitLab uses for SAML-based single sign-on (SSO) authentication.
The vulnerability occurs when a SAML response from an identity provider (IdP) contains a misconfiguration or is maliciously tampered with. Specifically, the flaw involves inadequate validation of key components in SAML assertions, such as the extern_uid (external user ID), which uniquely identifies a user across systems. An attacker can exploit this vulnerability by crafting a malicious SAML response, tricking GitLab into recognizing them as authenticated users, thereby bypassing SAML authentication and gaining unauthorized access.
Affected Versions:
- GitLab CE/EE versions 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10, and all earlier versions of those branches.
Patched Versions:
- The vulnerability has been patched in GitLab CE/EE versions 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10 by upgrading OmniAuth SAML to version 2.2.1 and Ruby-SAML to 1.17.0.
GitLab has reported potential signs of exploitation attempts, which may include:
- Errors related to RubySaml::ValidationError (unsuccessful attempts),
- New or unusual extern_uid values in authentication logs (successful attempts),
- Missing or incorrect information in SAML responses,
- Multiple extern_uid values for a single user (indicating potential account compromise),
- SAML authentication from unfamiliar or suspicious IP addresses.
In the advisory GitLab has provided example logs for successful and unsuccessful exploitation attempts to aid users in detecting potential attacks. While there are no confirmed reports of active exploitation, GitLab has acknowledged signs that malicious actors may be attempting to exploit this vulnerability.
Update - as of 6th of October 2024, a technical analysis and PoC exploit code is published about this flaw.
