Gitlab was impacted by Twin Critical Vulnerabilities

The CVE-2025-25291 and CVE-2025-25292 vulnerabilities represent critical security flaws impacting GitLab’s SAML (Security Assertion Markup Language)-based Single Sign-On (SSO) authentication mechanism. These vulnerabilities are particularly concerning as they allow attackers to bypass authentication protections and impersonate legitimate users, posing significant risks to organizations relying on SAML for identity and access management.

Vulnerability Breakdown

Type of Vulnerabilities

• Both CVE-2025-25291 and CVE-2025-25292 are categorized as Authentication Bypass Vulnerabilities.
• They exploit a parser differential flaw in the ruby-saml library, an open-source SAML implementation commonly used for SSO in applications such as GitLab.

Root Cause

• The vulnerabilities arise from inconsistent XML parsing behavior between two parsers used in ruby-saml:

1. REXML (Ruby Standard XML Parser)
2. Nokogiri (Ruby XML Parser based on libxml2)

• Due to this inconsistency, attackers can exploit the SAML Signature Wrapping (SSW) technique, where a maliciously crafted SAML response tricks the system into bypassing signature validation and accepting forged assertions.

Impact

An attacker with access to a valid SAML response (e.g., through intercepted or manipulated traffic) can:

Authenticate as Any User:

• This includes privileged accounts like administrators, providing full access to sensitive resources and functionalities in GitLab.

Impersonate Other Users:

• The attacker can operate under another user’s identity, accessing restricted repositories or leaking sensitive data.

Facilitate Privilege Escalation:

• Exploiting access to low-privileged accounts, an attacker could pivot to escalate their privileges further.

Affected GitLab Versions

GitLab’s affected versions span both Community Edition (CE) and Enterprise Edition (EE):

• Versions 17.7.6 and earlier.
• Versions 17.8.4 and earlier.
• Versions 17.9.1 and earlier.

Any instance of GitLab that utilizes SAML-based SSO with an unpatched version of the ruby-saml library is vulnerable to these attacks.

Exploitation Scenarios

Preconditions

• The attacker requires access to a legitimate signed SAML response (commonly used for authenticating users with an Identity Provider, or IdP).
• The GitLab instance must rely on a vulnerable version of ruby-saml for handling SAML authentication requests.

Attack Chain

Obtain Legitimate SAML Response:

• An attacker gains access to a valid signed SAML response through interception, phishing, or other means.

Craft Malicious Assertions:

• The attacker modifies the SAML response to include forged assertions, masquerading as a different user.

Send Tampered Response:

• The manipulated SAML response is sent to GitLab’s vulnerable authentication endpoint.

Bypass Authentication:

• Due to parser inconsistencies, GitLab accepts the malicious assertions as valid, granting the attacker unauthorized access.

This chain demonstrates how trivial it can be for an attacker to exploit SAML-related weaknesses in a production environment.

Impact on Organizations

The risks associated with these vulnerabilities are severe, especially for organizations managing sensitive data or critical projects through GitLab. Key impacts include:

Data Breaches:

• Unauthorized access to source code repositories, intellectual property, and business-critical files can result in significant financial and reputational damage.

Privilege Escalation and System Compromise:

• Attackers exploiting high-privileged accounts (e.g., administrators) can disable security mechanisms, create backdoors, and expand control within the organization’s infrastructure.

Loss of Trust:

• Compromised systems erode stakeholder trust, especially for organizations providing services or collaborating with external partners.

Regulatory and Compliance Risks:

• Breaches caused by these vulnerabilities can lead to non-compliance with regulations like GDPR, HIPAA, or SOC2, exposing organizations to legal liabilities and fines.

Mitigation Strategies

1. Apply GitLab Patches

GitLab has addressed CVE-2025-25291 and CVE-2025-25292 in the following versions:

• 17.7.7
• 17.8.5
• 17.9.2

To ensure protection:

• Update all GitLab instances to one of the patched versions or later.
• Check GitLab’s official advisory for instructions on updating.

2. Address SAML Security Gaps

• Disable optional features that increase attack surfaces, such as the SAML two-factor bypass option.
• Require administrative approval for new accounts created through SAML SSO to prevent unauthorized registrations.

3. Enforce Multi-Factor Authentication (MFA)

• Enable and enforce MFA for all user accounts, particularly privileged accounts.
• Ensure that all authentication mechanisms use strong, unique credentials and are monitored for suspicious activity.

4. Validate Configuration Security

• Audit SAML configurations to ensure they follow best practices:
• Use secure transport protocols (e.g., HTTPS) for SAML communication.
• Restrict access to the SSO service endpoint to trusted IP ranges.

5. Monitor and Detect

• Enable detailed logging for SSO events and monitor logs for anomalies, such as excessive login attempts or unexpected user account activity.
• Implement a Security Information and Event Management (SIEM) solution to detect abnormal patterns in user behavior.

Indicators of Compromise (IoCs)

Organizations should look for the following IoCs to identify potential exploitation:

1. Unexpected Administrative Logins:

• Multiple logins from administrative accounts originating from unknown IP addresses or unusual geolocations.

1. Unusual SAML Assertions:

• Logs indicating malformed or duplicated SAML responses could indicate manipulation.

1. Unauthorized Access Patterns:

• Accounts accessing resources they typically do not use, especially repositories containing sensitive data.

Additional Context

Discovery and Disclosure

• These vulnerabilities were identified by GitHub Security Lab as part of their ongoing efforts to enhance the security of open-source projects.
• GitLab was notified of the vulnerabilities in November 2024, and patches were released promptly to mitigate risks.

CVSS Scores

The vulnerabilities are assigned CVSS scores of 8.8, reflecting their high severity and the ease with which they can be exploited in real-world scenarios.

Final Thoughts

The discovery of CVE-2025-25291 and CVE-2025-25292 highlights the critical importance of securing authentication mechanisms in applications like GitLab, particularly when leveraging SAML-based SSO. Organizations using GitLab should act immediately to apply the recommended patches and implement additional mitigations to protect against these vulnerabilities.