Ruby-SAML Bypass && GitLab SAML Bypass(CVE-2024-45409)

OmniAuth::Strategy#callOmniAuth::Strategy#call!OmniAuth::Strategy#callback_callOmniAuth::Strategies::SAML#callback_phase

def callback_phase        raise OmniAuth::Strategies::SAML::ValidationError.new("SAML response missing") unless request.params["SAMLResponse"]        with_settings do |settings|# Call a fingerprint validation method if there's one          validate_fingerprint(settings) if options.idp_cert_fingerprint_validator          handle_response(request.params["SAMLResponse"], options_for_response_object, settings) dosuperendendrescue Omnidef handle_response(raw_response, opts, settings)        response = OneLogin::RubySaml::Response.new(raw_response, opts.merge(settings: settings))        response.attributes["fingerprint"] = settings.idp_cert_fingerprint        response.soft = false# 注意此处，SAMLResponse校验，也就是这里面存在绕过        response.is_valid?        @name_id = response.name_id        @session_index = response.sessionindex        @attributes = response.attributes        @response_object = response        session["saml_uid"] = @name_id        session["saml_session_index"] = @session_indexyieldend

  AuthHelper.providers_for_base_controller.each do |provider|    alias_method provider, :handle_omniauthenddef handle_omniauthif ::AuthHelper.saml_providers.include?(oauth['provider'].to_sym)      samlelse      omniauth_flow(Gitlab::Auth::OAuth)endend

// OmniauthCallbacksController#saml def saml    omniauth_flow(Gitlab::Auth::Saml)  rescue Gitlab::Auth::Saml::IdentityLinker::UnverifiedRequest    redirect_unverified_saml_initiation  end

// OmniauthCallbacksController#omniauth_flow  def omniauth_flow(auth_module, identity_linker: nil)    if fragment = request.env.dig('omniauth.params', 'redirect_fragment').presence      store_redirect_fragment(fragment)end    store_redirect_toif current_userreturn render_403 unless link_provider_allowed?(oauth['provider'])      // gitlab.rb  gitlab_rails['omniauth_providers']      set_session_active_since(oauth['provider']) if ::AuthHelper.saml_providers.include?(oauth['provider'].to_sym)      track_event(current_user, oauth['provider'], 'succeeded')if Gitlab::CurrentSettings.admin_modereturn admin_mode_flow(auth_module::User) if current_user_mode.admin_mode_requested?end      identity_linker ||= auth_module::IdentityLinker.new(current_user, oauth, session)return redirect_authorize_identity_link(identity_linker) if identity_linker.authorization_required?      link_identity(identity_linker)      // auth_module::User => Gitlab::Auth::Saml::User      current_auth_user = build_auth_user(auth_module::User)      set_remember_me(current_user, current_auth_user)      store_idp_two_factor_status(current_auth_user.bypass_two_factor?)if identity_linker.changed?        redirect_identity_linkedelsif identity_linker.failed?        redirect_identity_link_failed(identity_linker.error_message)else        redirect_identity_existsendelse      // auth_module::User => Gitlab::Auth::Saml::User      sign_in_user_flow(auth_module::User)endend

// OmniauthCallbacksController#sign_in_user_flow  def sign_in_user_flow(auth_user_class)    auth_user = build_auth_user(auth_user_class)# 创建Gitlab::Auth::Saml::User实例    new_user = auth_user.new?# 调用Gitlab::Auth::Saml::User#find_and_update!方法    @user = auth_user.find_and_update!if auth_user.valid_sign_in?# In this case the `#current_user` would not be set. So we can't fetch it# from that in `#context_user`. Pushing it manually here makes the information# available in the logs for this request.      Gitlab::ApplicationContext.push(user: @user)      track_event(@user, oauth['provider'], 'succeeded')      Gitlab::Tracking.event(self.class.name, "#{oauth['provider']}_sso", user: @user) if new_user      set_remember_me(@user, auth_user)      set_session_active_since(oauth['provider']) if ::AuthHelper.saml_providers.include?(oauth['provider'].to_sym)if @user.two_factor_enabled? && !auth_user.bypass_two_factor?        prompt_for_two_factor(@user)        store_idp_two_factor_status(false)elseif @user.deactivated?          @user.activate          flash[:notice] = _('Welcome back! Your account had been deactivated due to inactivity but is now reactivated.')        end# session variable for storing bypass two-factor request from IDP        store_idp_two_factor_status(true)        accept_pending_invitations(user: @user) if new_user        persist_accepted_terms_if_required(@user) if new_user        perform_registration_tasks(@user, oauth['provider']) if new_user        sign_in_and_redirect_or_verify_identity(@user, auth_user, new_user)      endelse      fail_login(@user)    end  rescue Gitlab::Auth::OAuth::User::IdentityWithUntrustedExternUidError    handle_identity_with_untrusted_extern_uid  rescue Gitlab::Auth::OAuth::User::SigninDisabledForProviderError    handle_disabled_provider  rescue Gitlab::Auth::OAuth::User::SignupDisabledError    handle_signup_error  end

// Gitlab::Auth::OAuth::User#find_and_update!  def find_and_update!    save if should_save?    gl_user  end// Gitlab::Auth::OAuth::User#gl_user        def gl_userreturn @gl_user if defined?(@gl_user)          @gl_user = find_user        end

// Gitlab::Auth::Saml::User#find_user        def find_user          user = find_by_uid_and_provider# github.rb  gitlab_rails['omniauth_auto_link_user'] = ['openid_connect']# 当开启omniauth_auto_link_user后会通过邮箱去寻找对应用户作为认证的目标用户# 注意此处user||=也就是当user为null的时候才会执行后面表达式          user ||= find_by_email if auto_link_saml_user?          user ||= find_or_build_ldap_user if auto_link_ldap_user?# 开启注册功能的时候会自定进行用户创建          user ||= build_new_user if signup_enabled?if user# 设置用户external属性            user.external = !(auth_hash.groups & saml_config.external_groups).empty? if external_users_enabled?end          userend// Gitlab::Auth::OAuth::User#find_by_email        def find_by_emailreturn unless auth_hash.has_attribute?(:email)          ::User.find_by(email: auth_hash.email.downcase)end

// OneLogin::RubySaml::Response#initialize      def initialize(response, options = {})        raise ArgumentError.new("Response cannot be nil") if response.nil?        @errors = []        @options = options        @soft = trueunless options[:settings].nil?          @settings = options[:settings]unless @settings.soft.nil?            @soft = @settings.soft          end        end# Base64解码并解析xml        @response = decode_raw_saml(response, settings)# 校验是否合法        @document = XMLSecurity::SignedDocument.new(@response, @errors)if assertion_encrypted?          @decrypted_document = generate_decrypted_document        end      end

def is_valid?(collect_errors = false)        validate(collect_errors)enddef validate(collect_errors = false)        reset_errors!return false unless validate_response_state        validations = [:validate_version,:validate_id,:validate_success_status,:validate_num_assertion,:validate_no_duplicated_attributes,:validate_signed_elements,:validate_structure,:validate_in_response_to,:validate_one_conditions,:validate_conditions,:validate_one_authnstatement,:validate_audience,:validate_destination,:validate_issuer,:validate_session_expiration,:validate_subject_confirmation,:validate_name_id,:validate_signature        ]if collect_errors          validations.each { |validation| send(validation) }          @errors.empty?else          validations.all? { |validation| send(validation) }endend