RubySec

Providing security resources for the Ruby community

CVE-2017-18076 (omniauth): omniauth leaks authenticity token in callback params

ADVISORIES

GEM

omniauth

SEVERITY

CVSS v3.x: 7.5 (High)

CVSS v2.0: 6.8 (Medium)

PATCHED VERSIONS

  • >= 1.3.2

DESCRIPTION

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.

RELATED