CVE-2025-66568
📋 TL;DR
The ruby-saml library versions up to 1.12.4 are vulnerable to authentication bypass via Signature Wrapping attacks. Attackers can exploit libxml2's canonicalization behavior on invalid XML to bypass SAML authentication. This affects any application using vulnerable ruby-saml versions for SAML authentication.
💻 Affected Systems
- ruby-saml library
📦 What is this software?
Ruby Saml by Onelogin
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to protected systems and data as any user.
Likely Case
Attackers gain unauthorized access to applications using SAML authentication, potentially compromising user accounts and sensitive data.
If Mitigated
With proper network segmentation and monitoring, impact limited to specific applications with detection of anomalous authentication attempts.
🎯 Exploit Status
Exploitation requires crafting malicious SAML responses but does not require authentication to the target system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.18.0
Vendor Advisory: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-x4h9-gwv3-r4m4
Restart Required: Yes
Instructions:
1. Update Gemfile to specify 'gem "ruby-saml", ">= 1.18.0"' 2. Run 'bundle update ruby-saml' 3. Restart your Ruby application 4. Test SAML authentication functionality
🔧 Temporary Workarounds
Input validation workaround
allAdd XML validation before canonicalization to reject invalid XML inputs
# Add custom validation in SAML response processing
# Reject XML that fails basic structure validation before canonicalization
🧯 If You Can't Patch
- Implement additional authentication factors (MFA) for all users
- Deploy WAF rules to detect and block suspicious SAML responses
🔍 How to Verify
Check if Vulnerable:
Check Gemfile.lock or run 'bundle show ruby-saml' to see installed versionCheck Version:
bundle show ruby-saml | grep -o "[0-9]\+\.[0-9]\+\.[0-9]\+"Verify Fix Applied:
Confirm version 1.18.0 or higher is installed and test SAML authentication with valid and invalid XML inputs📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful logins from same IP
- SAML responses with malformed XML structure
- Unusual user agent strings in authentication requests
Network Indicators:
- SAML responses containing XML parsing errors
- Multiple authentication attempts from single source with varying XML structures
SIEM Query:
source="application.log" AND ("SAML" AND ("invalid" OR "malformed" OR "canonicalization"))