GitLab and others are affected by CVE-2024-45409, a new XML signature wrapping attack impacting the Ruby implementation of SAML. This vulnerability allows attackers to log in as any user in the system. XML signatures are complex and prone to bugs, leading to multiple attacks affecting a wide range of the internet. SAML, used for enterprise single-sign-on, is the main reason behind the persistence of XML signatures. The solution lies in disregarding the flawed specification and implementing a more secure approach based on the common structure of SAML payloads. This attack highlights the importance of cautious engineering practices in the face of flawed standards.
https://ssoready.com/blog/engineering/ruby-saml-pwned-by-xml-signature-wrapping-attacks/