ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses

Vulnerability

Overview

The vulnerability resides in how ruby-saml handles compressed SAML responses. The library uses zlib to decompress responses, but the message size check is performed on the compressed payload before inflation, not on the decompressed result. This allows an attacker to submit a small compressed assertion that expands to a much larger size, bypassing the intended size limit [1][3][4].

Exploitation

An attacker can exploit this by sending a crafted SAML response to a service provider using ruby-saml. No prior authentication is required, and the attack can be carried out remotely. The compressed assertion evades the size validation, leading to excessive memory allocation or CPU consumption during decompression [3].

Impact

Successful exploitation results in a denial of service (DoS) condition. The application may become unresponsive or crash, disrupting SAML-based single sign-on functionality for legitimate users [1][3].

Mitigation

The issue is fixed in ruby-saml versions 1.12.4 and 1.18.0. Users are advised to upgrade to one of these patched releases. No workaround is documented [1][3][4].