RubySec

Providing security resources for the Ruby community

CVE-2017-18076 (omniauth): omniauth leaks authenticity token in callback params

ADVISORIES

GEM

omniauth

SEVERITY

CVSS v3: 7.5

CVSS v2: 6.8

PATCHED VERSIONS

  • >= 1.3.2

DESCRIPTION

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.