SAML Roulette: Exploiting Ruby-SAML for Unauthenticated GitLab Admin Access
PortSwigger researchers detailed a critical security vulnerability in the ruby-saml library, enabling unauthenticated administrator access to GitLab Enterprise. The exploit chains XML round-trip attacks with namespace confusion, leveraging parser differentials between REXML and Nokogiri. By manipulating XML comments and CDATA sections, attackers can mutate SAML assertions during re-parsing, bypassing signature verification and forging user identities. Although GitHub independently discovered and patched similar issues, their disclosure lacked specific technical details regarding the mutation technique. PortSwigger emphasizes the importance of sharing full exploitation methods to help organizations identify and mitigate such threats. The research highlights how structural inconsistencies in XML parsing allow attackers to assume any user's identity, escalating privileges to admin levels without authentication. This findings underscore significant risks in SAML implementations relying on inconsistent parsing libraries, urging developers to ensure consistent document serialization and validation to prevent unauthorized access and account takeovers in enterprise environments.
Wire timeline
SAML Roulette: Exploiting Ruby-SAML for Unauthenticated GitLab Admin Access
PortSwigger researchers detailed a critical security vulnerability in the ruby-saml library, enabling unauthenticated administrator access to GitLab Enterprise. The exploit chains XML round-trip attacks with namespace confusion, leveraging parser differentials between REXML and Nokogiri. By manipulating XML comments and CDATA sections, attackers can mutate SAML assertions during re-parsing, bypassing signature verification and forging user identities. Although GitHub independently discovered and patched similar issues, their disclosure lacked specific technical details regarding the mutation technique. PortSwigger emphasizes the importance of sharing full exploitation methods to help organizations identify and mitigate such threats. The research highlights how structural inconsistencies in XML parsing allow attackers to assume any user's identity, escalating privileges to admin levels without authentication. This findings underscore significant risks in SAML implementations relying on inconsistent parsing libraries, urging developers to ensure consistent document serialization and validation to prevent unauthorized access and account takeovers in enterprise environments.
PortSwigger Research