Get the latest tech news
Ruby-SAML pwned by XML signature wrapping attacks
GitLab and others are affected. The blame lies in the SAML specification, and in credulous engineers that implement it.
People hate on JWT because it forgot about (4); it’s part of an overarching attempt to standardize all of crypto under something called JOSE(and COSE), a bad idea. But Ruby-SAML has no reliable way of validating which parts of an XML document were signed, and so I wouldn’t be surprised if there were more issues in that codebase lurking. Responsible engineers should disregard what the SAML and XML Signatures spec authors wrote down, and instead implement the secure thing at its core.
Or read this on Hacker News