CVE-2015-20108

The ruby-saml gem versions prior to 1.0.0 contain an XPath injection vulnerability in the xml_security.rb file. The root cause is the failure to use prepared statements when handling XPath queries, allowing an attacker to inject malicious XPath expressions [2][3].

Exploitation does not require authentication if an attacker can supply a crafted SAML response. By injecting special characters into the XML, the attacker can manipulate XPath queries executed by the library, potentially achieving remote code execution [3].

Successful exploitation could grant an attacker full control over the application, leading to data theft, service disruption, or further compromise [3].

The vulnerability is fixed in ruby-saml version 1.0.0. Users are advised to upgrade immediately [2][4]. No workarounds are available.