{"schema":"vulnpedia.research/1","cve":"CVE-2024-45409","references":[{"url":"https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2","tags":["x_refsource_CONFIRM","Vendor Advisory","WEB"],"source":"mitre","sourceId":"GitHub_M","modified":"2024-09-11T21:03:29.185Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2024-09-11T21:03:29.185Z","url":"https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2"},{"source":"nvd","sourceId":"CVE-2024-45409","modified":"2026-06-17T07:54:09.650","url":"https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2"}]},{"url":"https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq","tags":["x_refsource_MISC","Vendor Advisory","WEB"],"source":"mitre","sourceId":"GitHub_M","modified":"2024-09-11T21:03:29.185Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2024-09-11T21:03:29.185Z","url":"https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq"},{"source":"nvd","sourceId":"CVE-2024-45409","modified":"2026-06-17T07:54:09.650","url":"https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq"}]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae","tags":["x_refsource_MISC","Patch","WEB"],"source":"mitre","sourceId":"GitHub_M","modified":"2024-09-11T21:03:29.185Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2024-09-11T21:03:29.185Z","url":"https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae"},{"source":"nvd","sourceId":"CVE-2024-45409","modified":"2026-06-17T07:54:09.650","url":"https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae"}]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7","tags":["x_refsource_MISC","Patch","WEB"],"source":"mitre","sourceId":"GitHub_M","modified":"2024-09-11T21:03:29.185Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2024-09-11T21:03:29.185Z","url":"https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7"},{"source":"nvd","sourceId":"CVE-2024-45409","modified":"2026-06-17T07:54:09.650","url":"https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7"}]},{"url":"https://ssoready.com/blog/engineering/ruby-saml-pwned-by-xml-signature-wrapping-attacks/","tags":[],"source":"mitre","sourceId":"CVE","modified":"2024-11-11T17:02:31.329Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2024-11-11T17:02:31.329Z","url":"https://ssoready.com/blog/engineering/ruby-saml-pwned-by-xml-signature-wrapping-attacks/"},{"source":"nvd","sourceId":"CVE-2024-45409","modified":"2026-06-17T07:54:09.650","url":"https://ssoready.com/blog/engineering/ruby-saml-pwned-by-xml-signature-wrapping-attacks/"}]},{"url":"https://news.ycombinator.com/item?id=41586031","tags":[],"source":"mitre","sourceId":"CVE","modified":"2024-11-11T17:02:31.329Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2024-11-11T17:02:31.329Z","url":"https://news.ycombinator.com/item?id=41586031"},{"source":"nvd","sourceId":"CVE-2024-45409","modified":"2026-06-17T07:54:09.650","url":"https://news.ycombinator.com/item?id=41586031"}]},{"url":"https://security.netapp.com/advisory/ntap-20240926-0008/","tags":[],"source":"mitre","sourceId":"CVE","modified":"2024-11-11T17:02:31.329Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2024-11-11T17:02:31.329Z","url":"https://security.netapp.com/advisory/ntap-20240926-0008/"},{"source":"nvd","sourceId":"CVE-2024-45409","modified":"2026-06-17T07:54:09.650","url":"https://security.netapp.com/advisory/ntap-20240926-0008/"}]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00006.html","tags":[],"source":"mitre","sourceId":"CVE","modified":"2024-11-11T17:02:31.329Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2024-11-11T17:02:31.329Z","url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00006.html"},{"source":"nvd","sourceId":"CVE-2024-45409","modified":"2026-06-17T07:54:09.650","url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00006.html"}]},{"url":"https://osv.dev/vulnerability/GHSA-jw9c-mfg7-9rx2","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","origins":[{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://osv.dev/vulnerability/GHSA-jw9c-mfg7-9rx2"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://osv.dev/vulnerability/GHSA-jw9c-mfg7-9rx2"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45409","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","origins":[{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45409"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45409"}]},{"url":"https://github.com/omniauth/omniauth-saml/commit/4274e9d57e65f2dcaae4aa3b2accf831494f2ddd","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","origins":[{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://github.com/omniauth/omniauth-saml/commit/4274e9d57e65f2dcaae4aa3b2accf831494f2ddd"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://github.com/omniauth/omniauth-saml/commit/4274e9d57e65f2dcaae4aa3b2accf831494f2ddd"}]},{"url":"https://github.com/SAML-Toolkits/ruby-saml","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","origins":[{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://github.com/SAML-Toolkits/ruby-saml"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://github.com/SAML-Toolkits/ruby-saml"}]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/CVE-2024-45409.yml","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","origins":[{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/CVE-2024-45409.yml"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/CVE-2024-45409.yml"}]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/GHSA-cvp8-5r8g-fhvq.yml","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","origins":[{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/GHSA-cvp8-5r8g-fhvq.yml"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-saml/GHSA-cvp8-5r8g-fhvq.yml"}]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2024-45409.yml","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","origins":[{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2024-45409.yml"},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2024-45409.yml"}]},{"source":"euvd","sourceId":"EUVD-2024-2828","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2828","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2024-2828","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2828"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2024-45409","modified":"2024-10-15T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2024-45409","modified":"2024-10-15T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://cyble.com/blog/active-exploitation-of-saml-vulnerability-cve-2024-45409-detected-by-cyble-sensors/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2024-45409","modified":"2024-10-15T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2024-45409","modified":"2024-10-15T00:00:00Z","url":"https://cyble.com/blog/active-exploitation-of-saml-vulnerability-cve-2024-45409-detected-by-cyble-sensors/"}]},{"url":"https://cyble.com/blog/cyble-sensors-detect-attacks-on-ivanti-php-saml-network-devices-and-more/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2024-45409","modified":"2024-10-15T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2024-45409","modified":"2024-10-15T00:00:00Z","url":"https://cyble.com/blog/cyble-sensors-detect-attacks-on-ivanti-php-saml-network-devices-and-more/"}]},{"url":"https://e.cyberint.com/hubfs/IAB%20Report%202025.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2024-45409","modified":"2024-10-15T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2024-45409","modified":"2024-10-15T00:00:00Z","url":"https://e.cyberint.com/hubfs/IAB%20Report%202025.pdf"}]},{"url":"https://vulncheck.com/xdb/bbbf2dd62a91","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"bbbf2dd62a91","modified":"2024-10-15T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"bbbf2dd62a91","modified":"2024-10-15T00:00:00Z","url":"https://vulncheck.com/xdb/bbbf2dd62a91"}]},{"url":"https://github.com/synacktiv/CVE-2024-45409","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"bbbf2dd62a91","modified":"2024-10-15T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"bbbf2dd62a91","modified":"2024-10-15T00:00:00Z","url":"https://github.com/synacktiv/CVE-2024-45409"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://osv.dev/vulnerability/GHSA-jw9c-mfg7-9rx2","ecosystem":"RubyGems","name":"ruby-saml","purl":"pkg:gem/ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.3"}]}],"versions":["0.0.5","0.0.6","0.0.7","0.0.8","0.2.1","0.2.2","0.2.3","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.5.0","0.5.1","0.5.2","0.5.3","0.6.0","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.10","0.8.11","0.8.12","0.8.13","0.8.14","0.8.15","0.8.16","0.8.17","0.8.18","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.9","0.9.1","0.9.2","0.9.3","0.9.4","1.0.0","1.1.0","1.1.1","1.1.2","1.10.0","1.10.1","1.10.2","1.11.0","1.12.0","1.12.1","1.12.2","1.2.0","1.3.0","1.3.1","1.4.0","1.4.1","1.4.2","1.4.3","1.5.0","1.6.0","1.6.1","1.6.2","1.7.0","1.7.1","1.7.2","1.8.0","1.9.0"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-jw9c-mfg7-9rx2/GHSA-jw9c-mfg7-9rx2.json"},"modified":"2026-08-07T08:11:51.793800677Z","origins":[{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://osv.dev/vulnerability/GHSA-jw9c-mfg7-9rx2"}]},{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","url":"https://osv.dev/vulnerability/GHSA-jw9c-mfg7-9rx2","ecosystem":"RubyGems","name":"ruby-saml","purl":"pkg:gem/ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.17.0"}]}],"versions":["1.13.0","1.14.0","1.15.0","1.16.0"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-jw9c-mfg7-9rx2/GHSA-jw9c-mfg7-9rx2.json"},"modified":"2026-08-07T08:11:51.793800677Z","origins":[{"source":"ghsa","sourceId":"GHSA-jw9c-mfg7-9rx2","modified":"2026-08-07T08:11:51.793800677Z","url":"https://osv.dev/vulnerability/GHSA-jw9c-mfg7-9rx2"}]}],"pocCandidates":[{"url":"https://github.com/synacktiv/CVE-2024-45409","source":"poc-in-github","sourceId":"CVE-2024-45409","description":"Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409) exploit","modified":"2026-10-13T19:06:45Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-45409","url":"https://github.com/synacktiv/CVE-2024-45409"},{"source":"poc-in-github","sourceId":"CVE-2024-45409","modified":"2026-10-13T19:06:45Z","url":"https://github.com/synacktiv/CVE-2024-45409"}],"tags":[]},{"url":"https://github.com/barkotenicholas/CVE-2024-45409","source":"poc-in-github","sourceId":"CVE-2024-45409","modified":"2026-10-25T11:01:17Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-45409","url":"https://github.com/barkotenicholas/CVE-2024-45409"},{"source":"poc-in-github","sourceId":"CVE-2024-45409","modified":"2026-10-25T11:01:17Z","url":"https://github.com/barkotenicholas/CVE-2024-45409"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"bbbf2dd62a91","url":"https://vulncheck.com/xdb/bbbf2dd62a91","cve":"CVE-2024-45409","dateAdded":"2024-10-22T15:58:44Z","modified":"2024-10-15T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/synacktiv/CVE-2024-45409","observations":[{"dateAdded":"2024-10-22T15:58:44Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"bbbf2dd62a91","modified":"2024-10-15T00:00:00Z","url":"https://vulncheck.com/xdb/bbbf2dd62a91"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2024-45409","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2024-10-15T00:00:00Z","modified":"2024-10-15T00:00:00Z","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"onelogin","product":"ruby-saml","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2024-45409","modified":"2024-10-15T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2024-45409","catalog":"VulnCheck KEV","kind":"report","url":"https://cyble.com/blog/active-exploitation-of-saml-vulnerability-cve-2024-45409-detected-by-cyble-sensors/","dateAdded":"2024-10-15T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2024-45409","url":"https://cyble.com/blog/active-exploitation-of-saml-vulnerability-cve-2024-45409-detected-by-cyble-sensors/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2024-45409","catalog":"VulnCheck KEV","kind":"report","url":"https://cyble.com/blog/cyble-sensors-detect-attacks-on-ivanti-php-saml-network-devices-and-more/","dateAdded":"2024-12-24T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2024-45409","url":"https://cyble.com/blog/cyble-sensors-detect-attacks-on-ivanti-php-saml-network-devices-and-more/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2024-45409","catalog":"VulnCheck KEV","kind":"report","url":"https://e.cyberint.com/hubfs/IAB%20Report%202025.pdf","dateAdded":"2025-04-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2024-45409","url":"https://e.cyberint.com/hubfs/IAB%20Report%202025.pdf"}]}]}