PT-2018-6657 · Omniauth · Omniauth

Lalith Rallabhandi · Published 2018-01-26 · Updated 2019-10-03 · CVE-2017-18076

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: OmniAuth versions prior to 1.3.2

Description: The issue arises from improper protection of the authenticity token value in OmniAuth. Specifically, in the strategy.rb file, POST parameters, in addition to GET parameters, are stored in the session and become accessible in the environment during the callback phase.

Recommendations: For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2017-18076

DSA-4109-1

GHSA-9PR6-GRF4-X2FR

Affected Products

Omniauth

References · 19

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth/CVE-2017-18076.yml · Exploit
• https://github.com/omniauth/omniauth/pull/867 · Patch
• https://github.com/omniauth/omniauth/pull/867/commits/71866c5264122e196847a3980c43051446a03e9b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-18076 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-18076 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4109-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4109 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18076 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-18076 · Security Note
• https://security-tracker.debian.org/tracker/DSA-4109-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/ruby-omniauth · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18076 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18076 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-18076 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-18076 · Vendor Advisory