CVE-2025-66567
📋 TL;DR
The ruby-saml library contains an authentication bypass vulnerability due to XML parsing differences between ReXML and Nokogiri, allowing attackers to execute Signature Wrapping attacks. This affects all applications using ruby-saml for SAML authentication up to version 1.12.4. Attackers can impersonate legitimate users and bypass authentication entirely.
💻 Affected Systems
- ruby-saml
📦 What is this software?
Ruby Saml by Onelogin
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing attackers to impersonate any user, access sensitive data, and perform unauthorized actions as any authenticated user.
Likely Case
Authentication bypass enabling unauthorized access to protected resources and potential privilege escalation.
If Mitigated
Limited impact with proper network segmentation, monitoring, and multi-factor authentication in place.
🎯 Exploit Status
Signature Wrapping attacks require understanding of SAML and XML parsing differences, but tools exist to automate such attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.18.0
Vendor Advisory: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3
Restart Required: Yes
Instructions:
1. Update Gemfile to specify 'gem "ruby-saml", ">= 1.18.0"' 2. Run 'bundle update ruby-saml' 3. Restart your Ruby application 4. Test SAML authentication functionality
🔧 Temporary Workarounds
Force Nokogiri XML parsing
allConfigure ruby-saml to use Nokogiri parser exclusively instead of ReXML
Set SAML_CONFIG[:idp_cert_fingerprint_algorithm] = "sha256"
Ensure Nokogiri gem is installed and configured as default XML parser
🧯 If You Can't Patch
- Implement additional authentication layers such as multi-factor authentication
- Monitor authentication logs for suspicious patterns and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check Gemfile.lock or run 'bundle show ruby-saml' to see installed versionCheck Version:
bundle show ruby-saml | grep -o "[0-9]\+\.[0-9]\+\.[0-9]\+"Verify Fix Applied:
Verify version is 1.18.0 or higher and test SAML authentication with malicious payloads📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns
- Multiple failed logins followed by successful login from same IP
- XML parsing errors in logs
Network Indicators:
- Unusual SAML request patterns
- Large XML payloads in authentication requests
- Multiple authentication attempts from single source
SIEM Query:
source="application.log" AND ("SAML" OR "authentication") AND ("error" OR "failed" OR "bypass")