Security researchers from GitHub Security Lab have identified parser differential vulnerabilities (CVE-2025-25291 and CVE-2025-25292) affecting ruby-saml versions up to 1.17.0, which could allow attackers to impersonate any user within affected systems. In the affected code, ruby-saml uses REXML to extract the signature element and SignatureValue, while Nokogiri is used to extract and canonicalize the SignedInfo element. Researchers discovered that an attacker could craft a malicious SAML response containing two different Signature elements—one visible to REXML and another visible to Nokogiri. This dual-parser approach creates a critical security flaw where the parsers interpret the same XML document differently, allowing attackers to manipulate verification checks. The vulnerabilities were discovered through a private bug bounty engagement initiated by GitHub to evaluate the security of the ruby-saml library. When validating SAML responses, the library performs two critical checks: comparing a calculated hash against a DigestValue and verifying the SignedInfo element against the SignatureValue. An attacker exploits this by ensuring that a valid SignedInfo with DigestValue is verified against a legitimate signature, while simultaneously having a fabricated assertion compared against its calculated digest. This technique effectively disconnects the hash verification from the signature verification, allowing attackers to bypass authentication mechanisms and gain unauthorized access to protected resources. The maintainer of ruby-saml, Sixto Martín, worked with security researchers to develop and release the fixes. This signature could come from a legitimate SAML response belonging to an unprivileged user or, in some cases, even from publicly accessible signed metadata of a SAML identity provider. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. An attacker with a valid signature created with the target organization’s key can construct SAML assertions for any user. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 14 Mar 2025 11:50:05 +0000