omniauth leaks authenticity token in callback params
Published: January 11, 2017
SECURITY IDENTIFIERS
- CVE: CVE-2017-18076 (NVD)
- GHSA: GHSA-9pr6-grf4-x2fr
- Vendor Advisory: https://github.com/omniauth/omniauth/pull/867
GEM
SEVERITY
PATCHED VERSIONS
>= 1.3.2
DESCRIPTION
In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.