CVE-2025-25293
📋 TL;DR
This vulnerability in ruby-saml allows remote attackers to cause Denial of Service (DoS) by sending specially crafted compressed SAML responses. The library checks message size before decompression, enabling attackers to bypass size limits and exhaust server resources. All applications using vulnerable versions of ruby-saml for SAML authentication are affected.
💻 Affected Systems
- ruby-saml
- GitLab (via ruby-saml dependency)
- Other Ruby applications using ruby-saml for SAML authentication
📦 What is this software?
Omniauth Saml by Omniauth
Omniauth Saml by Omniauth
Omniauth Saml by Omniauth
Ruby Saml by Onelogin
Ruby Saml by Onelogin
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, preventing legitimate users from authenticating via SAML SSO.
Likely Case
Service degradation or temporary unavailability requiring restart of affected services.
If Mitigated
Minimal impact with proper monitoring and resource limits in place.
🎯 Exploit Status
Attack requires sending a compressed SAML response to a vulnerable endpoint. No authentication needed if SAML endpoint is publicly accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.12.4 or 1.18.0
Vendor Advisory: https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
Restart Required: Yes
Instructions:
1. Update ruby-saml gem to version 1.12.4 or 1.18.0. 2. Update Gemfile to specify 'gem "ruby-saml", ">= 1.12.4"' or 'gem "ruby-saml", ">= 1.18.0"'. 3. Run 'bundle update ruby-saml'. 4. Restart application server.
🔧 Temporary Workarounds
Disable SAML response compression
allConfigure ruby-saml to reject compressed SAML responses entirely
Set 'settings.security[:reject_unsolicited_responses] = true' in SAML configuration
Set 'settings.security[:reject_compressed_responses] = true' if available
🧯 If You Can't Patch
- Implement rate limiting on SAML authentication endpoints
- Deploy WAF rules to detect and block suspicious compressed payloads to SAML endpoints
🔍 How to Verify
Check if Vulnerable:
Check Gemfile.lock or run 'bundle show ruby-saml' to see installed version. If version is below 1.12.4 or 1.18.0, system is vulnerable.Check Version:
bundle show ruby-saml | grep -o "[0-9]\+\.[0-9]\+\.[0-9]\+"Verify Fix Applied:
After update, verify version is 1.12.4 or higher with 'bundle show ruby-saml'. Test SAML authentication functionality remains working.📡 Detection & Monitoring
Log Indicators:
- Unusually large SAML response processing
- Memory exhaustion errors in application logs
- Failed authentication attempts with compressed payloads
Network Indicators:
- High volume of compressed SAML responses to authentication endpoints
- Unusual traffic patterns to SAML endpoints
SIEM Query:
source="application.log" AND ("memory exhausted" OR "SAML response too large" OR "decompression error")🔗 References
- https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released
- https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials
- https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be349a
- https://github.com/SAML-Toolkits/ruby-saml/commit/e2da4c6dae7dc01a4d9cd221395140a67e2b3eb1
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-92rq-c8cf-prrq
- https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
- https://securitylab.github.com/advisories/GHSL-2024-355_ruby-saml
- https://lists.debian.org/debian-lts-announce/2025/04/msg00011.html
- https://security.netapp.com/advisory/ntap-20250314-0008/
